HTTP Request/Response Smuggling Vulnerability in HAProxy
Summary
DEBIAN-CVE-2024-53008: Inconsistent interpretation of HTTP requests ('HTTP Request/Response Smuggling') issue exists in HAProxy. Affects haproxy versions < 2.9.10-1. Fixed in 2.9.10-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HAProxy is a widely used open-source software that provides high availability, load balancing, and proxying for TCP and HTTP-based applications. It is known for its performance and reliability, making it a popular choice for managing web traffic. However, HAProxy is susceptible to certain vulnerabilities, including the recent HTTP Request/Response Smuggling issue, which can compromise the security of applications relying on it.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2024-53008 arises from an inconsistent interpretation of HTTP requests, allowing a remote attacker to exploit this flaw. By manipulating HTTP requests, an attacker may gain unauthorized access to paths restricted by Access Control Lists (ACLs) set within HAProxy. This could lead to the exposure of sensitive information, posing a significant risk to the integrity and confidentiality of the affected systems.
How To Fix
Minimum fixed version
2.9.10-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade haproxyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to sensitive paths by modifying their ACL configurations in HAProxy. This may involve reviewing and tightening the rules that govern access to critical resources until the patch can be applied.
Conclusion
The HTTP Request/Response Smuggling vulnerability in HAProxy poses a serious risk to applications relying on this software. It is crucial for users to update to the patched version to safeguard their systems. Additionally, implementing temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for haproxy →
FAQ
The vulnerability is related to HTTP Request/Response Smuggling, which allows attackers to bypass access controls.
If you are using HAProxy versions prior to 2.9.10-1, your installation is vulnerable to this issue.
Exploitation of this vulnerability could lead to unauthorized access to sensitive information, compromising the security of your applications.
Yes, you can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software without needing to access the code directly.
Consider implementing stricter ACL rules and reviewing your HAProxy configuration to limit access to sensitive paths until the patch is applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for haproxy.
