From fd127517b9dcdfb8b98b8e2d7d4f402ba0fda416 Mon Sep 17 00:00:00 2001
From: Steve Kamerman <stevekamerman@gmail.com>
Date: Tue, 19 Jul 2016 11:03:41 -0400
Subject: [PATCH] Added comments about httpoxy

---
 README.md  | 4 ++++
 nginx.tmpl | 2 ++
 2 files changed, 6 insertions(+)

diff --git a/README.md b/README.md
index f54cc0b..53e8d5d 100644
--- a/README.md
+++ b/README.md
@@ -205,11 +205,15 @@ proxy_set_header Connection $proxy_connection;
 proxy_set_header X-Real-IP $remote_addr;
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+
+# Mitigate httpoxy attack (see README for details)
 proxy_set_header Proxy "";
 ```
 
 ***NOTE***: If you provide this file it will replace the defaults; you may want to check the .tmpl file to make sure you have all of the needed options.
 
+***NOTE***: The default configuration blocks the `Proxy` HTTP request header from being sent to downstream servers.  This prevents attackers from using the so-called [httpoxy attack](http://httpoxy.org).  There is no legitimate reason for a client to send this header, and there are many vulnerable languages / platforms (`CVE-2016-5385`, `CVE-2016-5386`, `CVE-2016-5387`, `CVE-2016-5388`, `CVE-2016-1000109`, `CVE-2016-1000110`, `CERT-VU#797896`).
+
 #### Proxy-wide
 
 To add settings on a proxy-wide basis, add your configuration file under `/etc/nginx/conf.d` using a name ending in `.conf`.
diff --git a/nginx.tmpl b/nginx.tmpl
index 19a1274..0969564 100644
--- a/nginx.tmpl
+++ b/nginx.tmpl
@@ -51,6 +51,8 @@ proxy_set_header Connection $proxy_connection;
 proxy_set_header X-Real-IP $remote_addr;
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
+
+# Mitigate httpoxy attack (see README for details)
 proxy_set_header Proxy "";
 {{ end }}