CVE-2023-25725: Critical severity HAProxy HAProxy vulnerability
A flaw was found in HAProxy's headers processing that causes HAProxy to drop important headers fields such as Connection, Content-length, Transfer-Encoding, and Host after having partially processed them. A maliciously crafted HTTP request could be used in an HTTP request smuggling attack to bypass filtering and detection by HAProxy.
Other sources
HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." The HTTP header parsers in HAProxy may accept empty header field names, which could be used to truncate the list of HTTP headers and thus make some headers disappear after being parsed and processed for HTTP/1.0 and HTTP/1.1. For HTTP/2 and HTTP/3, the impact is limited because the headers disappear before being parsed and processed, as if they had not been sent by the client. The fixed versions are 2.7.3, 2.6.9, 2.5.12, 2.4.22, 2.2.29, and 2.0.31.
I will attach the patch to this flaw, but there may be an even newer patch available from the reporter (Willy Tarreau).
Summary from the initial report: There is a serious bug in haproxy's HTTP/1 header parser which unfortunately accepts an empty header name ... The impact is that some mandatory headers could be dropped after their presence was confirmed ... resulting in a request smuggling attack. Also this empty header could be used to make a transfer-encoding or content-length disappear while the internal parser still thinks it's there since it was seen ... I guess some (attackers) might be creative enough to exploit it ...
The fix ... applies well as far as v2.0 ...
I would like to propose an early coordinated release date ... Tuesday 14th 7pm CET ... it shouldn't take long to some attackers to figure how to exploit this to bypass some URL checks
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/haproxyto a version that resolves this vulnerability.Fixed in 0:2.4.17-3.el9_1.2 - Upgrade
Upgrade
redhat/haproxyto a version that resolves this vulnerability.Fixed in 0:2.4.7-2.el9_0.2 - Upgrade
Upgrade
redhat/haproxyto a version that resolves this vulnerability.Fixed in 0:2.2.19-4.el8 - Upgrade
Upgrade
redhat/haproxyto a version that resolves this vulnerability.Fixed in 0:2.2.24-3.rhaos4.11.el8 - Upgrade
Upgrade
redhat/haproxyto a version that resolves this vulnerability.Fixed in 0:2.2.24-3.rhaos4.12.el8 - Upgrade
Upgrade
redhat/haproxyto a version that resolves this vulnerability.Fixed in 0:2.2.24-3.rhaos4.13.el8 - Upgrade
Upgrade
redhat/HAProxyto a version that resolves this vulnerability.Fixed in 2.0.31 - Upgrade
Upgrade
redhat/HAProxyto a version that resolves this vulnerability.Fixed in 2.2.29 - Upgrade
Upgrade
redhat/HAProxyto a version that resolves this vulnerability.Fixed in 2.4.22 - Upgrade
Upgrade
redhat/HAProxyto a version that resolves this vulnerability.Fixed in 2.5.12 - Upgrade
Upgrade
redhat/HAProxyto a version that resolves this vulnerability.Fixed in 2.6.9 - Upgrade
Upgrade
redhat/HAProxyto a version that resolves this vulnerability.Fixed in 2.7.3 - Upgrade
Upgrade
redhat/HAProxyto a version that resolves this vulnerability.Fixed in 2.8 - Upgrade
Upgrade
debian/haproxyto a version that resolves this vulnerability.Fixed in 2.2.9-2+deb11u6Fixed in 2.2.9-2+deb11u7Fixed in 2.6.12-1+deb12u3Fixed in 3.0.11-1+deb13u3Fixed in 3.2.22-1 - Upgrade
Upgrade
haproxyto a version that resolves this vulnerability.Fixed in 2.7.3 - Upgrade
Upgrade
haproxyto a version that resolves this vulnerability.Fixed in 2.6.9 - Upgrade
Upgrade
haproxyto a version that resolves this vulnerability.Fixed in 2.5.12 - Upgrade
Upgrade
haproxyto a version that resolves this vulnerability.Fixed in 2.4.22 - Upgrade
Upgrade
haproxyto a version that resolves this vulnerability.Fixed in 2.2.29 - Upgrade
Upgrade
haproxyto a version that resolves this vulnerability.Fixed in 2.0.31
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2023-25725?
CVE-2023-25725 is a vulnerability in HAProxy that allows bypass of access control through request smuggling.
What is the severity of CVE-2023-25725?
CVE-2023-25725 has a severity rating of 9.1 (Critical).
How does CVE-2023-25725 affect HAProxy?
CVE-2023-25725 affects HAProxy versions before 2.7.3 and may cause the loss of important HTTP/1 headers, leading to a bypass of access control.
How can I fix CVE-2023-25725?
To fix CVE-2023-25725, update HAProxy to version 2.7.3 or later.
Where can I find more information about CVE-2023-25725?
You can find more information about CVE-2023-25725 at the following references: [Bugzilla - 2169823](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2169823), [Bugzilla - 2170060](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2170060), [Red Hat Security Advisory - CVE-2023-25725](https://access.redhat.com/security/cve/CVE-2023-25725).