This is a guest post written by Alex Bod, Information Security Researcher and the founder of the Gods Hackers Team.   The information about a set of vulnerabilities called HTTPoxy was published on July 18. Using this, attackers can replace the HTTP_PROXY environment variable that allows them to redirect http-queries to the Web applications on their resources. The vulnerability was identified in partnership with the developer Dominic Scheirlinck, who in his blog talked about how the vulnerability was discovered by his colleagues in the analysis of one of the tickets, received in support.   How it works   Scheirlinck explains in detail the principle of the HTTPoxy work. A typical attack using this vulnerability set is as follows: The attacker creates a specially crafted HTTP-request, which contains the Proxy header; CGI receives the request and saves the header value in the HTTP_PROXY environment variable; CGI application runs its own web client that uses the HTTP_PROXY environment variable for the proxy settings; The client sends the request that instead of the destination address is proxied through the attacker’s server.   For instance, the exploitation code in several popular languages could look like this: PHP: $client = new GuzzleHttp\Client(); $client->get(‘http://api.internal/?secret=foo’)   Python: from…