HAProxy Vulnerability: IP Spoofing in QUIC Sessions
Summary
DEBIAN-CVE-2024-49214: QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. Affects haproxy versions < 2.9.11-1. Fixed in 2.9.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HAProxy is a widely used open-source software that provides high availability, load balancing, and proxying for TCP and HTTP-based applications. It is known for its performance and reliability, making it a popular choice for managing web traffic. However, certain versions of HAProxy are vulnerable to a security issue in the QUIC protocol, which can allow malicious actors to bypass IP allow/block lists.
Vulnerability Detail
QUIC in HAProxy versions 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows the establishment of a 0-RTT session using a spoofed IP address. This vulnerability can be exploited to circumvent the IP filtering mechanisms, potentially leading to unauthorized access and manipulation of traffic. The issue arises from the way HAProxy handles QUIC sessions, failing to properly validate the source IP address during the session initiation process.
How To Fix
Minimum fixed version
2.9.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade haproxyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling QUIC support in HAProxy until the package can be updated. This can be done by modifying the HAProxy configuration file to exclude QUIC settings, thus preventing the establishment of vulnerable sessions.
Conclusion
The HAProxy vulnerability related to QUIC sessions poses a significant risk by allowing IP spoofing, which can undermine security measures. It is crucial for users to update to the latest patched versions to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for haproxy →
FAQ
The vulnerability allows attackers to bypass IP filtering, potentially leading to unauthorized access and manipulation of traffic.
HAProxy versions 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider disabling QUIC support in your HAProxy configuration as a temporary workaround.
More information can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-49214.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for haproxy.
