CVE-2023-40225 – HAProxy versions through multiple branches forw... (How to Fix)

Q: What is the severity of CVE-2023-40225?

CVE-2023-40225 has a CVSS score of 7.2 (HIGH). HAProxy versions through multiple branches forward empty Content-Length headers, violating HTTP standards. This can cause HTTP/1 servers behind HAProxy to misinterpret requests, potentially treating payload data as additional requests. Organizations using affected HAProxy versions as reverse proxies or load balancers are vulnerable.

📋 TL;DR

HAProxy versions through multiple branches forward empty Content-Length headers, violating HTTP standards. This can cause HTTP/1 servers behind HAProxy to misinterpret requests, potentially treating payload data as additional requests. Organizations using affected HAProxy versions as reverse proxies or load balancers are vulnerable.

💻 Affected Systems

Products:

HAProxy

Versions: 2.0 through 2.0.32, 2.1.x, 2.2.x through 2.2.30, 2.3.x, 2.4.x through 2.4.23, 2.5.x, 2.6.x before 2.6.15, 2.7.x before 2.7.10, 2.8.x before 2.8.2

Operating Systems: All platforms running HAProxy

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects HTTP/1 backend servers; HTTP/2 backends are not vulnerable

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Request smuggling leading to cache poisoning, session hijacking, or unauthorized access to backend systems

🟠

Likely Case

Request parsing errors causing application instability, failed transactions, or degraded service

🟢

If Mitigated

Minor request processing anomalies with no security impact if backend servers properly validate headers

🌐 Internet-Facing: MEDIUM - Exploitation requires specific conditions but could lead to request smuggling attacks

🏢 Internal Only: LOW - Internal systems typically have additional controls and less exposure to malicious actors

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires specific backend server behavior and uncommon conditions per CVE description

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.6.15, 2.7.10, 2.8.2, or later versions in respective branches

Vendor Advisory: https://www.haproxy.org

Restart Required: Yes

Instructions:

1. Identify HAProxy version with 'haproxy -v'. 2. Download patched version from haproxy.org. 3. Stop HAProxy service. 4. Install new version. 5. Restart HAProxy service.

🔧 Temporary Workarounds

HTTP/2 Backend Configuration

all

Configure HAProxy to use HTTP/2 for backend connections where supported

backend my_backend
  server srv1 192.168.1.1:80 proto h2

Content-Length Header Filtering

all

Use HAProxy configuration to filter or normalize empty Content-Length headers

http-request set-header Content-Length "" if { hdr_val(Content-Length) eq 0 }

🧯 If You Can't Patch

Implement WAF or reverse proxy in front of HAProxy to filter malicious requests
Configure backend servers to reject requests with empty Content-Length headers

🔍 How to Verify

Check if Vulnerable:

Run 'haproxy -v' and compare version against affected ranges

Check Version:

haproxy -v

Verify Fix Applied:

Verify version is 2.6.15+, 2.7.10+, 2.8.2+, or later branch versions

📡 Detection & Monitoring

Log Indicators:

Backend server errors related to request parsing
HTTP 400/413 errors from backend servers

Network Indicators:

Unusual request patterns with empty Content-Length headers
Multiple requests appearing as single request to backend

SIEM Query:

source="haproxy.log" AND ("Content-Length:" AND "\"\"")

📊 Metadata

CVE ID: CVE-2023-40225

CVSS v3 Score: 7.2 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

CWE: CWE-444

Published: August 10, 2023

Last Updated: November 21, 2024

🔗 References

https://cwe.mitre.org/data/definitions/436.html Technical Description
https://github.com/haproxy/haproxy/commit/6492f1f29d738457ea9f382aca54537f35f9d856 Patch
https://github.com/haproxy/haproxy/issues/2237 Exploit,Issue Tracking,Vendor Advisory
https://www.haproxy.org/download/2.6/src/CHANGELOG Release Notes
https://www.haproxy.org/download/2.7/src/CHANGELOG Release Notes
https://www.haproxy.org/download/2.8/src/CHANGELOG Release Notes
https://cwe.mitre.org/data/definitions/436.html Technical Description
https://github.com/haproxy/haproxy/commit/6492f1f29d738457ea9f382aca54537f35f9d856 Patch
https://github.com/haproxy/haproxy/issues/2237 Exploit,Issue Tracking,Vendor Advisory
https://www.haproxy.org/download/2.6/src/CHANGELOG Release Notes
https://www.haproxy.org/download/2.7/src/CHANGELOG Release Notes
https://www.haproxy.org/download/2.8/src/CHANGELOG Release Notes

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-40225, you might also want to check these:

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Haproxy by Haproxy

Haproxy by Haproxy

Haproxy by Haproxy

Haproxy by Haproxy

Haproxy by Haproxy

Haproxy by Haproxy

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

HTTP/2 Backend Configuration

Content-Length Header Filtering

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities