HTTPoxy Scanner
Summary: PortSwigger lists a Burp Suite Professional extension, authored by Guifre Ruiz, that adds an active scan check for the HTTPoxy vulnerability. HTTPoxy arises when an application reads the Proxy header from an HTTP request, saves it to the HTTP_PROXY environment variable, and the server's outgoing HTTP requests are then proxied through it. The extension requires Burp Suite Professional v1.7.09 or later, is at version 1.0, was last updated 25 August 2021, and carries an overall system impact rating of Low.
Bottom line: HTTPoxy turns a single request header into control over where a server sends its own outbound traffic, so any application that copies Proxy into HTTP_PROXY can have its backend calls silently redirected. The extension's own Low impact rating reflects the tooling, not your exposure - the check only helps if it runs against the applications that make outbound requests.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026