CVE-2016-5387

What it actually does

The server passes an untrusted client-supplied Proxy request header into the HTTP_PROXY environment variable for CGI scripts and similar application environments, allowing an attacker to control the outbound proxy used by the application for HTTP requests.

Why it matters to the business

Applications running behind affected servers can have their outbound HTTP traffic silently redirected to an attacker-controlled proxy, enabling interception or manipulation of sensitive data such as API calls or external service requests, with high urgency for legacy systems still in use after many years.

How an attack unfolds

An attacker crafts an HTTP request containing a Proxy header pointing to a malicious proxy server. When the backend application (such as a CGI script) initiates an outbound HTTP connection, the server has already populated HTTP_PROXY from the header, causing the connection to route through the attacker's proxy for eavesdropping or redirection.

How to fix it

Configure the web server to unset or sanitize the Proxy header before passing requests to applications (for example, using RequestHeader unset Proxy early in the configuration). Update to patched versions of Apache HTTP Server or affected products where available, and apply vendor-specific mitigations for legacy deployments.

How to confirm the fix worked

Inspect server configuration for rules that explicitly unset the Proxy header; test by sending requests with a Proxy header and verifying that the HTTP_PROXY environment variable is not populated in the application environment; review logs for unexpected outbound proxy usage.

Typical attack path

1. Identify a target server running an affected version of Apache HTTP Server or similar products that passes request headers to application environments.
2. Send a crafted HTTP request containing a malicious Proxy header.
3. Trigger the application to make an outbound HTTP request (for example, to an external API).
4. Observe or manipulate the traffic as it is routed through the attacker-controlled proxy.

How to detect it

Review web server access logs for requests containing a Proxy header; examine application logs or environment dumps for unexpected HTTP_PROXY values; look for unusual outbound connections from application processes to unknown proxy endpoints.

• Proxy:.* in HTTP request headers
• HTTP_PROXY environment variable set from client header
• outbound connections to attacker-specified proxy hosts

What your security team should do

• Immediately audit all Apache HTTP Server and related deployments for Proxy header handling configurations.
• Apply header unset rules as a primary mitigation since fixed versions are not universally listed.
• Monitor for any applications making outbound HTTP calls that could be affected.
• Prioritize remediation on internet-facing systems given the stable high EPSS score and broad product exposure.