Does httproxy vulnerability extend to Elixir applications?

Question

Should I reset the proxy header for an Elixir / Phoenix application that uses the nginx proxy (s. Https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/ ) or is the platform not affected?

Answer 1

Cowboy does not use cgi, so this does not apply.

Also, if you do not use http libraries to call basic services, this will not apply. And if you do this, and these http libraries do not use the HTTP_PROXYvar environment to set up the proxy server, then you are fine. Hackney (what HttPoison is based on) doesn't seem to do this, you will need to configure the proxy by calling the functionconnect_proxy/5

Documents say ...

Transport = hackney_tcp_transport,
Host = << "https://friendpaste.com" >>,
Port = 443,
Options = [],
{ok, ConnRef} = hackney:connect(Transport, Host, Port, Options)

To create a connection that will use an HTTP proxy use hackney_http_proxy:connect_proxy/5 instead.