{"id":9000,"date":"2016-07-21T17:44:17","date_gmt":"2016-07-21T15:44:17","guid":{"rendered":"https:\/\/www.siteground.es\/blog\/?p=9000"},"modified":"2023-03-01T09:53:36","modified_gmt":"2023-03-01T09:53:36","slug":"vulnerabilidad-httpoxy","status":"publish","type":"post","link":"https:\/\/www.siteground.es\/blog\/vulnerabilidad-httpoxy\/","title":{"rendered":"A salvo de la vulnerabilidad httpoxy  o c\u00f3mo ir un paso por delante compensa"},"content":{"rendered":"<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-9007 size-full\" src=\"https:\/\/www.siteground.es\/blog\/wp-content\/uploads\/2016\/07\/httpoxy-vulnerability-1.jpg\" alt=\"httpoxy-vulnerability (1)\" width=\"660\" height=\"300\"><\/p>\n<p>Una peligrosa vulnerabilidad f\u00e1cil de explotar llamada <span style=\"color: #000080\"><u><span lang=\"es-ES\"><a href=\"https:\/\/httpoxy.org\/\" target=\"_blank\" rel=\"noopener noreferrer\">httpoxy<\/a><\/span><\/u><span lang=\"es-ES\">&nbsp;<\/span><\/span><span lang=\"es-ES\">descubierta hace 15 a\u00f1os, ha reaparecido esta semana de nuevo, dejando el software web que reside en los servidores potencialmente&nbsp;<\/span><span lang=\"es-ES\">vulnerable a ataques y amenazas. Este agujero de seguridad afecta a un gran n\u00famero de aplicaciones web PHP y CGI. Esto significa que todo lo que funcione con PHP, Apache, Go, HHVM, Python puede ser vulnerable si se ve afectado. Este exploit facilita ataques intermedios que pueden comprometer los servidores web y acceder potencialmente a datos sensibles o incluso, tomar el control del c\u00f3digo. Gracias a nuestro sistema \u00fanico desarrollado por nosotros, y a muchas precauciones tomadas de antemano y a tiempo por nuestro equipo de desarrolladores, los clientes de SiteGround no se han visto afectados por el regreso de esta vulnerabilidad. <\/span><br \/>\n<!--more--><\/p>\n<h3>\u00bfC\u00f3mo funciona este fallo?<\/h3>\n<p><span lang=\"es-ES\">El atacante elabora un encabezado Proxy HTTP espec\u00edfico en una solicitud a la aplicaci\u00f3n para crear un entorno variable com\u00fan llamado HTTP_PROXY en el servidor de aplicaciones. Entonces la aplicaci\u00f3n, debido a un conflicto de nombre usa el servidor proxy definido en esa variable en cualquiera de las conexiones HTTP salientes. De esta manera si el atacante ha apuntado el HTTP_PROXY a un servidor malicioso, puede interceptar las conexiones de la aplicaci\u00f3n web a otros sistemas y, dependiendo de como est\u00e9 dise\u00f1ado el c\u00f3digo, tener potencialmente el control remoto de la ejecuci\u00f3n del mismo. La mejor forma de mitigarlo es bloqueando las peticiones del encabezado PROXY lo antes posible, antes de que impacten en tu aplicaci\u00f3n.<\/span><\/p>\n<h3>\u00bfC\u00f3mo evitamos que nos afecte la vulnerabilidad ahora?<\/h3>\n<p><span lang=\"es-ES\">Tenemos nuestra propia configuraci\u00f3n PHP y CGI que desarrollamos en 2007 y que contin\u00faa manteni\u00e9ndose y mejor\u00e1ndose hasta hoy. Tiempo atr\u00e1s, cuando nuestro equipo de desarrolladores empez\u00f3 a trabajar en ella, se dieron cuenta que hab\u00eda un fallo potencial en el uso del encabezado PROXY. Por eso, como precauci\u00f3n, decidieron excluir el encabezado PROXY de nuestra lista de par\u00e1metros de entorno permitidos. Esto significa que no s\u00f3lo no necesitamos desconfigurar el encabezado HTTP_PROXY como los expertos de seguridad recomiendan en estos casos, sino que simplemente no permitimos que se incluya en ninguna petici\u00f3n HTTP. <\/span><\/p>\n<p><span lang=\"es-ES\">Gracias a nuestros especialistas en seguridad y nuestro equipo de dise\u00f1o de sistemas, somos capaces de predecir este tipo de vulnerabilidades y dise\u00f1ar proactivamente nuestros sistemas de manera que, si por alguna raz\u00f3n esas vulnerabilidades reaparecen, nuestros clientes sigan a salvo y protegidos.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"Una peligrosa vulnerabilidad f\u00e1cil de explotar llamada httpoxy&nbsp;descubierta hace 15 a\u00f1os, ha reaparecido esta semana de nuevo, dejando el software web que reside en los servidores potencialmente&nbsp;vulnerable a ataques y amenazas. Este agujero de seguridad afecta a un gran n\u00famero de aplicaciones web PHP y CGI. Esto significa que todo lo que funcione con PHP,&hellip;","protected":false},"author":57,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2533],"tags":[],"class_list":["post-9000","post","type-post","status-publish","format-standard","hentry","category-novedades-de-producto"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v24.2 (Yoast SEO v24.2) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Protecci\u00f3n contra la vulnerabilidad HTTPOXY<\/title>\n<meta name=\"description\" content=\"Gracias a nuestros especialistas en seguridad y equipo de dise\u00f1o de sistemas, los clientes de SiteGround no han sido afectados por el regreso de la vulnerabilidad HTTPOXY.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/newblog.siteground.com\/es\/vulnerabilidad-httpoxy\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"A salvo de la vulnerabilidad httpoxy o c\u00f3mo ir un paso por delante compensa | El blog de SiteGround\" \/>\n<meta property=\"og:description\" content=\"Gracias a nuestros especialistas en seguridad y equipo de dise\u00f1o de sistemas, los clientes de SiteGround no han sido afectados por el regreso de la vulnerabilidad HTTPOXY.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/newblog.siteground.com\/es\/vulnerabilidad-httpoxy\/\" \/>\n<meta property=\"og:site_name\" content=\"SiteGround\" \/>\n<meta property=\"article:published_time\" content=\"2016-07-21T15:44:17+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-03-01T09:53:36+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/newblog.siteground.com\/es\/wp-content\/uploads\/sites\/4\/2016\/07\/httpoxy-vulnerability-1.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"660\" \/>\n\t<meta property=\"og:image:height\" content=\"300\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Daniel Kanchev\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Daniel Kanchev\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/newblog.siteground.com\/es\/vulnerabilidad-httpoxy\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/newblog.siteground.com\/es\/vulnerabilidad-httpoxy\/\"},\"author\":{\"name\":\"Daniel Kanchev\",\"@id\":\"https:\/\/newblog.siteground.com\/es\/#\/schema\/person\/380162a677d6c37329e9a12baa334572\"},\"headline\":\"A salvo de la vulnerabilidad httpoxy o c\u00f3mo ir un paso por delante compensa\",\"datePublished\":\"2016-07-21T15:44:17+00:00\",\"dateModified\":\"2023-03-01T09:53:36+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/newblog.siteground.com\/es\/vulnerabilidad-httpoxy\/\"},\"wordCount\":441,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/newblog.siteground.com\/es\/#organization\"},\"image\":{\"@id\":\"https:\/\/newblog.siteground.com\/es\/vulnerabilidad-httpoxy\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.siteground.es\/blog\/wp-content\/uploads\/2016\/07\/httpoxy-vulnerability-1.jpg\",\"articleSection\":[\"Novedades de producto\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/newblog.siteground.com\/es\/vulnerabilidad-httpoxy\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/newblog.siteground.com\/es\/vulnerabilidad-httpoxy\/\",\"url\":\"https:\/\/newblog.siteground.com\/es\/vulnerabilidad-httpoxy\/\",\"name\":\"Protecci\u00f3n contra la vulnerabilidad HTTPOXY\",\"isPartOf\":{\"@id\":\"https:\/\/newblog.siteground.com\/es\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/newblog.siteground.com\/es\/vulnerabilidad-httpoxy\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/newblog.siteground.com\/es\/vulnerabilidad-httpoxy\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.siteground.es\/blog\/wp-content\/uploads\/2016\/07\/httpoxy-vulnerability-1.jpg\",\"datePublished\":\"2016-07-21T15:44:17+00:00\",\"dateModified\":\"2023-03-01T09:53:36+00:00\",\"description\":\"Gracias a nuestros especialistas en seguridad y equipo de dise\u00f1o de sistemas, los clientes de SiteGround no han sido afectados por el regreso de la vulnerabilidad HTTPOXY.\",\"breadcrumb\":{\"@id\":\"https:\/\/newblog.siteground.com\/es\/vulnerabilidad-httpoxy\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/newblog.siteground.com\/es\/vulnerabilidad-httpoxy\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/newblog.siteground.com\/es\/vulnerabilidad-httpoxy\/#primaryimage\",\"url\":\"https:\/\/www.siteground.es\/blog\/wp-content\/uploads\/2016\/07\/httpoxy-vulnerability-1.jpg\",\"contentUrl\":\"https:\/\/www.siteground.es\/blog\/wp-content\/uploads\/2016\/07\/httpoxy-vulnerability-1.jpg\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/newblog.siteground.com\/es\/vulnerabilidad-httpoxy\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/newblog.siteground.com\/es\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"A salvo de la vulnerabilidad httpoxy o c\u00f3mo ir un paso por delante compensa\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/newblog.siteground.com\/es\/#website\",\"url\":\"https:\/\/newblog.siteground.com\/es\/\",\"name\":\"El blog de SiteGround\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/newblog.siteground.com\/es\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/newblog.siteground.com\/es\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/newblog.siteground.com\/es\/#organization\",\"name\":\"SiteGround Espa\u00f1a\",\"url\":\"https:\/\/newblog.siteground.com\/es\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/newblog.siteground.com\/es\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/newblog.siteground.com\/es\/wp-content\/uploads\/sites\/4\/2025\/01\/cropped-Siteground-Logo-on-white.jpg\",\"contentUrl\":\"https:\/\/newblog.siteground.com\/es\/wp-content\/uploads\/sites\/4\/2025\/01\/cropped-Siteground-Logo-on-white.jpg\",\"width\":166,\"height\":250,\"caption\":\"SiteGround Espa\u00f1a\"},\"image\":{\"@id\":\"https:\/\/newblog.siteground.com\/es\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/newblog.siteground.com\/es\/#\/schema\/person\/380162a677d6c37329e9a12baa334572\",\"name\":\"Daniel Kanchev\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/newblog.siteground.com\/es\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/f0baefb86ae4d35a2e71cb0966e1847f?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/f0baefb86ae4d35a2e71cb0966e1847f?s=96&d=mm&r=g\",\"caption\":\"Daniel Kanchev\"},\"sameAs\":[\"https:\/\/www.linkedin.com\/in\/daniel-kanchev-29716455\/\"],\"url\":\"https:\/\/newblog.siteground.com\/es\/author\/daniel\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Protecci\u00f3n contra la vulnerabilidad HTTPOXY","description":"Gracias a nuestros especialistas en seguridad y equipo de dise\u00f1o de sistemas, los clientes de SiteGround no han sido afectados por el regreso de la vulnerabilidad HTTPOXY.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/newblog.siteground.com\/es\/vulnerabilidad-httpoxy\/","og_locale":"en_US","og_type":"article","og_title":"A salvo de la vulnerabilidad httpoxy o c\u00f3mo ir un paso por delante compensa | El blog de SiteGround","og_description":"Gracias a nuestros especialistas en seguridad y equipo de dise\u00f1o de sistemas, los clientes de SiteGround no han sido afectados por el regreso de la vulnerabilidad HTTPOXY.","og_url":"https:\/\/newblog.siteground.com\/es\/vulnerabilidad-httpoxy\/","og_site_name":"SiteGround","article_published_time":"2016-07-21T15:44:17+00:00","article_modified_time":"2023-03-01T09:53:36+00:00","og_image":[{"width":660,"height":300,"url":"https:\/\/newblog.siteground.com\/es\/wp-content\/uploads\/sites\/4\/2016\/07\/httpoxy-vulnerability-1.jpg","type":"image\/jpeg"}],"author":"Daniel Kanchev","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Daniel Kanchev","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/newblog.siteground.com\/es\/vulnerabilidad-httpoxy\/#article","isPartOf":{"@id":"https:\/\/newblog.siteground.com\/es\/vulnerabilidad-httpoxy\/"},"author":{"name":"Daniel Kanchev","@id":"https:\/\/newblog.siteground.com\/es\/#\/schema\/person\/380162a677d6c37329e9a12baa334572"},"headline":"A salvo de la vulnerabilidad httpoxy o c\u00f3mo ir un paso por delante compensa","datePublished":"2016-07-21T15:44:17+00:00","dateModified":"2023-03-01T09:53:36+00:00","mainEntityOfPage":{"@id":"https:\/\/newblog.siteground.com\/es\/vulnerabilidad-httpoxy\/"},"wordCount":441,"commentCount":0,"publisher":{"@id":"https:\/\/newblog.siteground.com\/es\/#organization"},"image":{"@id":"https:\/\/newblog.siteground.com\/es\/vulnerabilidad-httpoxy\/#primaryimage"},"thumbnailUrl":"https:\/\/www.siteground.es\/blog\/wp-content\/uploads\/2016\/07\/httpoxy-vulnerability-1.jpg","articleSection":["Novedades de producto"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/newblog.siteground.com\/es\/vulnerabilidad-httpoxy\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/newblog.siteground.com\/es\/vulnerabilidad-httpoxy\/","url":"https:\/\/newblog.siteground.com\/es\/vulnerabilidad-httpoxy\/","name":"Protecci\u00f3n contra la vulnerabilidad HTTPOXY","isPartOf":{"@id":"https:\/\/newblog.siteground.com\/es\/#website"},"primaryImageOfPage":{"@id":"https:\/\/newblog.siteground.com\/es\/vulnerabilidad-httpoxy\/#primaryimage"},"image":{"@id":"https:\/\/newblog.siteground.com\/es\/vulnerabilidad-httpoxy\/#primaryimage"},"thumbnailUrl":"https:\/\/www.siteground.es\/blog\/wp-content\/uploads\/2016\/07\/httpoxy-vulnerability-1.jpg","datePublished":"2016-07-21T15:44:17+00:00","dateModified":"2023-03-01T09:53:36+00:00","description":"Gracias a nuestros especialistas en seguridad y equipo de dise\u00f1o de sistemas, los clientes de SiteGround no han sido afectados por el regreso de la vulnerabilidad HTTPOXY.","breadcrumb":{"@id":"https:\/\/newblog.siteground.com\/es\/vulnerabilidad-httpoxy\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/newblog.siteground.com\/es\/vulnerabilidad-httpoxy\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/newblog.siteground.com\/es\/vulnerabilidad-httpoxy\/#primaryimage","url":"https:\/\/www.siteground.es\/blog\/wp-content\/uploads\/2016\/07\/httpoxy-vulnerability-1.jpg","contentUrl":"https:\/\/www.siteground.es\/blog\/wp-content\/uploads\/2016\/07\/httpoxy-vulnerability-1.jpg"},{"@type":"BreadcrumbList","@id":"https:\/\/newblog.siteground.com\/es\/vulnerabilidad-httpoxy\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/newblog.siteground.com\/es\/"},{"@type":"ListItem","position":2,"name":"A salvo de la vulnerabilidad httpoxy o c\u00f3mo ir un paso por delante compensa"}]},{"@type":"WebSite","@id":"https:\/\/newblog.siteground.com\/es\/#website","url":"https:\/\/newblog.siteground.com\/es\/","name":"El blog de SiteGround","description":"","publisher":{"@id":"https:\/\/newblog.siteground.com\/es\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/newblog.siteground.com\/es\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/newblog.siteground.com\/es\/#organization","name":"SiteGround Espa\u00f1a","url":"https:\/\/newblog.siteground.com\/es\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/newblog.siteground.com\/es\/#\/schema\/logo\/image\/","url":"https:\/\/newblog.siteground.com\/es\/wp-content\/uploads\/sites\/4\/2025\/01\/cropped-Siteground-Logo-on-white.jpg","contentUrl":"https:\/\/newblog.siteground.com\/es\/wp-content\/uploads\/sites\/4\/2025\/01\/cropped-Siteground-Logo-on-white.jpg","width":166,"height":250,"caption":"SiteGround Espa\u00f1a"},"image":{"@id":"https:\/\/newblog.siteground.com\/es\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/newblog.siteground.com\/es\/#\/schema\/person\/380162a677d6c37329e9a12baa334572","name":"Daniel Kanchev","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/newblog.siteground.com\/es\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/f0baefb86ae4d35a2e71cb0966e1847f?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f0baefb86ae4d35a2e71cb0966e1847f?s=96&d=mm&r=g","caption":"Daniel Kanchev"},"sameAs":["https:\/\/www.linkedin.com\/in\/daniel-kanchev-29716455\/"],"url":"https:\/\/newblog.siteground.com\/es\/author\/daniel\/"}]}},"_links":{"self":[{"href":"https:\/\/newblog.siteground.com\/es\/wp-json\/wp\/v2\/posts\/9000","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/newblog.siteground.com\/es\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/newblog.siteground.com\/es\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/newblog.siteground.com\/es\/wp-json\/wp\/v2\/users\/57"}],"replies":[{"embeddable":true,"href":"https:\/\/newblog.siteground.com\/es\/wp-json\/wp\/v2\/comments?post=9000"}],"version-history":[{"count":2,"href":"https:\/\/newblog.siteground.com\/es\/wp-json\/wp\/v2\/posts\/9000\/revisions"}],"predecessor-version":[{"id":14970,"href":"https:\/\/newblog.siteground.com\/es\/wp-json\/wp\/v2\/posts\/9000\/revisions\/14970"}],"wp:attachment":[{"href":"https:\/\/newblog.siteground.com\/es\/wp-json\/wp\/v2\/media?parent=9000"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/newblog.siteground.com\/es\/wp-json\/wp\/v2\/categories?post=9000"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/newblog.siteground.com\/es\/wp-json\/wp\/v2\/tags?post=9000"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}