Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| guzzlehttp/guzzle | composer | < 7.14.2 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the improper handling of the Proxy-Authorization header in Guzzle's cURL and stream handlers. This header, intended only for the proxy, was being included in the headers sent to the origin server under certain conditions. This could lead to the leakage of sensitive proxy credentials.
The patch addresses this issue by modifying the core handler functions responsible for creating and managing requests.
In CurlFactory.php, the create function is modified to intercept the Proxy-Authorization header and move it to a separate, proxy-only channel (CURLOPT_PROXYHEADER) if the installed version of libcurl supports it. If not, it prevents the request from being sent if a proxy is configured, thus avoiding the leak.
In StreamHandler.php, the getDefaultContext function is updated to explicitly filter out the Proxy-Authorization header from the list of headers sent with the request. The createStream and add_proxy functions are also updated to ensure that the Proxy-Authorization header is only added when a proxy is actually in use and is handled correctly.
By analyzing the patch that fixes the vulnerability, I was able to identify the exact functions where the flawed logic existed. These are the functions that would appear in a runtime profile when the vulnerability is triggered.
GuzzleHttp\Handler\CurlFactory::createsrc/Handler/CurlFactory.php
GuzzleHttp\Handler\StreamHandler::createStreamsrc/Handler/StreamHandler.php
GuzzleHttp\Handler\StreamHandler::getDefaultContextsrc/Handler/StreamHandler.php
GuzzleHttp\Handler\StreamHandler::add_proxysrc/Handler/StreamHandler.php