Cloudanix VulnDB

CVE-2023-0836

High · 7.5

CVSS

7.5

EPSS

1.2%

Published

Mar 29, 2023

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A bug in the HAProxy load balancer can accidentally send small pieces of internal memory contents to the applications it talks to.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Data Exposure
Component
Network Service
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw leaves 5 bytes of uninitialized memory in the HAProxy connection buffer during FCGI_BEGIN_REQUEST record encoding, allowing sensitive data from process memory to be sent to configured FastCGI backends.

Why it matters to the business

Organizations running affected HAProxy versions risk unintended disclosure of internal data to backend applications, potentially leading to compliance violations or exposure of credentials and session material without requiring authentication.

How an attack unfolds

An attacker positions a FastCGI backend under their control or influence, then issues requests that cause HAProxy to encode FCGI_BEGIN_REQUEST records; the uninitialized bytes containing residual memory contents are transmitted to the backend where they can be inspected.

How to fix it

Upgrade HAProxy to 2.2.27, 2.4.21, 2.5.11, 2.6.8, 2.7.1 or later; for the referenced git tree apply commit 2f51eeb60f7f07e76a3248ba9a0757236216aed3; disable or strictly control FastCGI backends until patched.

How to confirm the fix worked

Confirm the running HAProxy binary reports a patched version or contains the cited commit; perform controlled FCGI request tests while inspecting backend receive buffers for absence of uninitialized data.

Typical attack path

  1. Identify internet-facing or internal HAProxy deployments running versions 2.1-2.7 prior to the listed patches
  2. Deploy or compromise a FastCGI backend reachable by the load balancer
  3. Send traffic that triggers FCGI_BEGIN_REQUEST encoding paths
  4. Capture and analyze the 5-byte fragments received at the backend for sensitive content

How to detect it

Review FastCGI backend application logs and network captures for unexpected short data fragments arriving immediately after FCGI_BEGIN_REQUEST records; correlate with HAProxy access logs showing requests that exercise FastCGI paths.

What your security team should do

  • Prioritize upgrade of all HAProxy instances to fixed releases within the next maintenance window
  • Audit FastCGI backend reachability and apply least-privilege network controls
  • Add version checks to vulnerability scanning policies for HAProxy

The record

An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitialized in the connection buffer when encoding the FCGI_BEGIN_REQUEST record. Sensitive data may be disclosed to configured FastCGI backends in an unexpected way.

Affected packages

Ecosystem Package Introduced Fixed
AlmaLinux:9 haproxy 0 2.4.22-1.el9
Bitnami haproxy 2.1.0 2.1.1
Bitnami haproxy 2.2.0 2.2.27
Debian:11 haproxy 0 2.2.9-2+deb11u5
Debian:12 haproxy 0 2.6.8-1
Debian:13 haproxy 0 2.6.8-1
Debian:14 haproxy 0 2.6.8-1
Red Hat:enterprise_linux:9::appstream haproxy 0 0:2.4.22-1.el9
Red Hat:enterprise_linux:9::appstream haproxy-debuginfo 0 0:2.4.22-1.el9
Red Hat:enterprise_linux:9::appstream haproxy-debugsource 0 0:2.4.22-1.el9
Ubuntu:22.04:LTS haproxy 0 2.4.18-0ubuntu1.3

Related vulnerabilities