CVE-2022-0711
📋 TL;DR
CVE-2022-0711 is a denial-of-service vulnerability in HAProxy where specially crafted HTTP responses containing Set-Cookie2 headers can trigger an infinite loop, causing the service to become unresponsive. This affects HAProxy instances processing HTTP traffic, potentially impacting any organization using vulnerable versions as load balancers or reverse proxies. The vulnerability requires an attacker to send malicious responses that HAProxy processes.
💻 Affected Systems
- HAProxy
📦 What is this software?
Haproxy by Haproxy
Haproxy by Haproxy
Haproxy by Haproxy
⚠️ Risk & Real-World Impact
Worst Case
Complete HAProxy service outage leading to denial of service for all backend applications, requiring manual restart and causing extended downtime.
Likely Case
HAProxy process consumes 100% CPU and becomes unresponsive, requiring restart and causing temporary service disruption.
If Mitigated
If proper network segmentation and input validation are in place, impact is limited to the HAProxy instance itself without affecting backend services.
🎯 Exploit Status
Exploitation requires the attacker to control HTTP responses that HAProxy processes, which could be achieved through various means including compromised upstream servers or man-in-the-middle attacks.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: HAProxy 2.4.18, 2.5.9, or 2.6.0 and later
Vendor Advisory: https://access.redhat.com/security/cve/cve-2022-0711
Restart Required: Yes
Instructions:
1. Download latest patched version from haproxy.org 2. Stop HAProxy service 3. Install new version 4. Restart HAProxy service 5. Verify functionality
🔧 Temporary Workarounds
Filter Set-Cookie2 Headers
allUse HAProxy configuration to filter or block Set-Cookie2 headers
http-response del-header Set-Cookie2
Rate Limiting
allImplement rate limiting on HTTP responses to limit potential DoS impact
stick-table type ip size 100k expire 30s store http_req_rate(10s)
tcp-request connection track-sc0 src
tcp-request connection reject if { src_http_req_rate gt 100 }
🧯 If You Can't Patch
- Implement network segmentation to limit which systems can send HTTP responses to HAProxy
- Deploy WAF or reverse proxy in front of HAProxy to filter malicious traffic
🔍 How to Verify
Check if Vulnerable:
Check HAProxy version with 'haproxy -v' and compare against affected versions (before 2.4.18, 2.5.9, 2.6.0)Check Version:
haproxy -v | grep -o 'version [0-9.]*'Verify Fix Applied:
Verify version is 2.4.18+, 2.5.9+, or 2.6.0+ and test with known exploit patterns📡 Detection & Monitoring
Log Indicators:
- High CPU usage spikes
- HAProxy process restarting frequently
- Connection timeouts
- Error logs showing processing loops
Network Indicators:
- Unusual HTTP responses containing Set-Cookie2 headers
- Traffic patterns causing HAProxy CPU spikes
SIEM Query:
source="haproxy.log" AND ("high cpu" OR "timeout" OR "loop")🔗 References
- https://access.redhat.com/security/cve/cve-2022-0711
- https://github.com/haproxy/haproxy/commit/bfb15ab34ead85f64cd6da0e9fb418c9cd14cee8
- https://www.debian.org/security/2022/dsa-5102
- https://www.mail-archive.com/haproxy%40formilux.org/msg41833.html
- https://access.redhat.com/security/cve/cve-2022-0711
- https://github.com/haproxy/haproxy/commit/bfb15ab34ead85f64cd6da0e9fb418c9cd14cee8
- https://www.debian.org/security/2022/dsa-5102
- https://www.mail-archive.com/haproxy%40formilux.org/msg41833.html
