Login Sign Up

CVE-2021-39240

7.5 HIGH

📋 TL;DR

HAProxy versions before 2.2.16, 2.3.13, and 2.4.3 have a URI validation vulnerability where the proxy fails to properly validate scheme and path characters in HTTP/2 requests. This allows attackers to potentially bypass routing rules and access unauthorized backend servers. Organizations using vulnerable HAProxy versions as HTTP/2 reverse proxies are affected.

💻 Affected Systems

Products:
  • HAProxy
Versions: 2.2 before 2.2.16, 2.3 before 2.3.13, 2.4 before 2.4.3
Operating Systems: All platforms running HAProxy
Default Config Vulnerable: ⚠️ Yes
Notes: Only affects HTTP/2 configurations. HTTP/1.x configurations are not vulnerable.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Fedora by Fedoraproject

View all CVEs affecting Fedora →

Fedora by Fedoraproject

View all CVEs affecting Fedora →

Haproxy by Haproxy

View all CVEs affecting Haproxy →

Haproxy by Haproxy

View all CVEs affecting Haproxy →

Haproxy by Haproxy

View all CVEs affecting Haproxy →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could bypass security controls and routing rules to access internal services, potentially leading to data exposure, privilege escalation, or lateral movement within the network.

🟠

Likely Case

Unauthorized access to backend services that should be restricted, potentially exposing sensitive applications or data to external attackers.

🟢

If Mitigated

With proper network segmentation and additional security controls, impact is limited to potential routing rule bypass without direct access to critical systems.

🌐 Internet-Facing: HIGH
🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ⚠️ Yes
Complexity: MEDIUM

Exploitation requires understanding of HTTP/2 protocol and HAProxy routing configurations. No public exploit code has been released.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.2.16, 2.3.13, 2.4.3

Vendor Advisory: https://git.haproxy.org/?p=haproxy.git;a=commit;h=4b8852c70d8c4b7e225e24eb58258a15eb54c26e

Restart Required: Yes

Instructions:

1. Download latest patched version from haproxy.org 2. Backup current configuration 3. Install new version 4. Restart HAProxy service

🔧 Temporary Workarounds

Disable HTTP/2

all

Temporarily disable HTTP/2 support to mitigate the vulnerability

# Edit HAProxy config and remove 'alpn h2' from bind lines
# Remove 'proto h2' from server lines

Use HTTP/1.1 Only

all

Force all connections to use HTTP/1.1 protocol

# Add 'option http-use-htx' and 'option force-http10' to frontend sections

🧯 If You Can't Patch

  • Implement strict network segmentation to limit backend server exposure
  • Add additional authentication/authorization layers before backend services

🔍 How to Verify

Check if Vulnerable:

Check HAProxy version with 'haproxy -v' and verify if using HTTP/2

Check Version:

haproxy -v | grep 'version'

Verify Fix Applied:

Verify version is 2.2.16+, 2.3.13+, or 2.4.3+ and test HTTP/2 routing functionality

📡 Detection & Monitoring

Log Indicators:

  • Unusual routing patterns
  • HTTP/2 requests with malformed URIs
  • Access to restricted backend services

Network Indicators:

  • HTTP/2 traffic bypassing expected routing rules
  • Unusual backend server access patterns

SIEM Query:

source="haproxy" AND (uri_contains("..") OR uri_contains("\\") OR status_code=403)

📊 Metadata

CVE ID: CVE-2021-39240
CVSS v3 Score: 7.5 (HIGH)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published: August 17, 2021
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON