VULNERABLE Handlers:

wsgiref.handlers.CGIHandler

VULNERABLE - This is explicitly mentioned in the HTTPoxy documentation as vulnerable. Python code must be deployed under CGI to be vulnerable, and this usually means using wsgiref.handlers.CGIHandler. This handler uses sys.stdin, sys.stdout, sys.stderr and os.environ, making it directly susceptible to environment variable pollution from HTTP headers.

wsgiref.handlers.IISCGIHandler

VULNERABLE - This is a specialized subclass of CGIHandler designed for Microsoft's IIS web server. Since it inherits from CGIHandler and operates in the same CGI environment where os.environ gets polluted by HTTP headers, it has the same vulnerability.

wsgiref.handlers.BaseCGIHandler

VULNERABLE - This is the base class for CGI handlers that CGIHandler inherits from. The documentation states it's "intended for use with software other than HTTP origin servers" and is designed for "gateway protocol implementation (such as CGI, FastCGI, SCGI, etc.)". Since it operates in CGI-like environments where HTTP headers become environment variables, it's vulnerable.

NOT VULNERABLE Handlers:

wsgiref.handlers.SimpleHandler

NOT VULNERABLE - The documentation specifically states this is "designed for use with HTTP origin servers" and "If you are writing an HTTP server implementation, you will probably want to subclass this instead of BaseCGIHandler." Since regular WSGI environments keep user-supplied values in a separate WSGI 'environ' map, they are not vulnerable. The os.environ['HTTP_PROXY'] remains unchanged when a Proxy header is sent.

wsgiref.handlers.BaseHandler

NOT VULNERABLE - This is an abstract base class for running WSGI applications. It's designed for HTTP origin servers, not CGI environments. The documentation shows it maintains separate environment handling and doesn't directly expose os.environ to HTTP header pollution.

Key Distinction:

The vulnerability comes down to whether the handler operates in a CGI environment where:

• HTTP headers are mixed into environment variables
• os.environ['HTTP_PROXY'] can be set by a malicious Proxy: header

CGI-based handlers (CGIHandler, IISCGIHandler, BaseCGIHandler) are vulnerable because they operate in environments where this header-to-environment variable mapping occurs.

HTTP origin server handlers (SimpleHandler, BaseHandler) are not vulnerable because they maintain proper separation between HTTP headers and environment variables, keeping user-supplied data in separate WSGI environ dictionaries.