CVE-2016-4694

CVE-2016-4694, also known as an "httpoxy" issue, affects Apache HTTP Server in Apple OS X before 10.12 and OS X Server before 5.2. This vulnerability allows remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server. It achieves this by exploiting the server's adherence to RFC 3875, which permits untrusted CGI client data in the HTTP_PROXY environment variable. The vulnerability carries a critical CVSS score of 9.1, indicating a severe risk. It is easily exploitable over the network with low attack complexity, requiring no user interaction or privileges. A successful exploit could lead to high confidentiality and integrity impacts, as attackers could intercept or manipulate an application's HTTP traffic. There is no evidence of active exploitation, and no public exploit code is available for this CVE, including Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are minimal, suggesting a lack of widespread attention or current exploitation.