CVE-2024-37082
📋 TL;DR
This vulnerability allows attackers to bypass mTLS authentication to Cloud Foundry applications by crafting specific HTTP requests. It affects deployments using haproxy-boshrelease with route-services enabled and the 'ha_proxy.forwarded_client_cert' property set to 'forward_only_if_route_service'.
💻 Affected Systems
- Cloud Foundry
- haproxy-boshrelease
- routing-release
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Unauthenticated attackers could access sensitive applications and data protected by mTLS authentication, potentially leading to data breaches or unauthorized system access.
Likely Case
Attackers bypass mTLS protection to access backend applications that should require mutual TLS authentication.
If Mitigated
With proper network segmentation and additional authentication layers, impact is limited to specific route-service endpoints.
🎯 Exploit Status
Exploitation requires specific HTTP request crafting but no authentication
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: haproxy-boshrelease v0.18.0+
Vendor Advisory: https://www.cloudfoundry.org/blog/cve-2024-37082-mtls-bypass/
Restart Required: Yes
Instructions:
1. Update haproxy-boshrelease to v0.18.0 or later
2. Update routing-release to latest version
3. Restart haproxy instances
4. Verify configuration changes
🔧 Temporary Workarounds
Disable vulnerable configuration
linuxChange ha_proxy.forwarded_client_cert to a non-vulnerable setting or disable route-services
bosh -d <deployment> update-config --type=cloud --name=haproxy -v ha_proxy.forwarded_client_cert=always
🧯 If You Can't Patch
- Implement network-level controls to restrict access to route-service endpoints
- Add additional authentication/authorization layers for applications behind mTLS
🔍 How to Verify
Check if Vulnerable:
Check if route-services enabled AND ha_proxy.forwarded_client_cert = 'forward_only_if_route_service' in deployment manifestCheck Version:
bosh -d <deployment> instances --ps | grep haproxyVerify Fix Applied:
Verify haproxy-boshrelease version >= 0.18.0 and configuration updated📡 Detection & Monitoring
Log Indicators:
- HTTP requests bypassing mTLS to route-service endpoints
- Unexpected client certificate validation failures
Network Indicators:
- HTTP traffic to mTLS-protected endpoints without proper TLS handshake
SIEM Query:
source="haproxy" AND (http_request_uri CONTAINS "route-service" OR x-forwarded-client-cert MISSING)