Question HTTPoxy vulnerability: CVE-2016-5387

[Faris Raouf]

Does this affect the Admin CP side of Plesk 10.4.4 ?

Has anyone come up with a solution?

Yes, I know 10.4.4 is EOL. But it is till used widely, and it would be nice to know if it is affected and how to resolve it if it is.

 

[UFHH01]

Hi Faris Raouf,

did you notice

HTTPoxy vulnerability: CVE-2016-5387 ( KB - article 129391 )
​

... and the provided resolutions?:

...
In other cases when the vendor's PHP version is being used on the Plesk server:
...

 

[Faris Raouf]

KB129391 deals with the customer-side (hosting) php/nginx/apache.

What I am concerned about is the Plesk admin panel php and webserver, specifically for 10.4.4 as it is EOL.

I'm pretty sure even Plesk 10 uses its own php, and its own webserver (nginx?), which are not provided by the vendor.

I realise that in order to be exploited, the vulnerability requires the running application to be coded in a certain way and to do certain things.
If Plesk is not coded in such a way then there is no problem. But I do not know one way or another.

 

[UFHH01]

Hi Faris Raouf,

What I am concerned about is the Plesk admin panel php and webserver, specifically for 10.4.4 as it is EOL.

I'm not sure, if I remember it right, but isn't there as well the file "/etc/sw-cp-server/fastcgi.conf", where you could as well add as suggested:

3. For Plesk panel:

~# sudo cat << EOF >> /etc/sw-cp-server/fastcgi.conf

# Mitigate httpoxy. Details: https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/
fastcgi_param HTTP_PROXY "";
EOF

 

[Faris Raouf]

I had looked into that, and there is no fastcgi.conf or similar anywhere in Plesk 10.4.4.

A bell at the back of my head is saying "litespeed" not nginx for Plesk in 10.4.4, but that might be wrong.

 

[IgorG]

A bell at the back of my head is saying "litespeed" not nginx for Plesk in 10.4.4, but that might be wrong.

As far as I remember sw-cp-server is based on litespeed...

 

[SalvadorS]

Hello,

Can anybody tell me how to do this?

3. For Plesk panel:

~# sudo cat << EOF >> /etc/sw-cp-server/fastcgi.conf

# Mitigate httpoxy. Details: https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/
fastcgi_param HTTP_PROXY "";
EOF

I type:

sudo cat << EOF >> /etc/sw-cp-server/fastcgi.conf

Then:

>

Have I to paste # Mitigate httpoxy. Details: https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/
fastcgi_param HTTP_PROXY "";
EOF
?
And then how I close it?

Thanks a lot

 

[IgorG]

And then how I close it?

Press Enter.

 

[SalvadorS]

Thanks IgorG, as fast as always.

So I have to do that in all the servers with plesk under 12.0, isn´t it? 12.0 and up are fixed by MU.

 

[IgorG]

So I have to do that in all the servers with plesk under 12.0, isn´t it? 12.0 and up are fixed by MU.

Install all latest microupdates on your Plesk server and check output of

# grep 'fastcgi_param HTTP_PROXY' /etc/sw-cp-server/fastcgi.conf

if there is no record

fastcgi_param HTTP_PROXY "";

you need to add it manually.