Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| io.netty:netty-codec-haproxy | maven | >= 4.2.0.Final, < 4.2.16.Final | 4.2.16.Final |
| io.netty:netty-codec-haproxy | maven | < 4.1.136.Final | 4.1.136.Final |
Miggo AIRoot Cause AnalysisThe vulnerability is a CRLF injection in Netty's HAProxy V1 protocol encoder. It occurs when using AF_UNIX socket addresses. The root cause is twofold. First, the HAProxyMessage class did not properly validate AF_UNIX addresses for protocol-illegal characters like carriage returns (CR), line feeds (LF), or spaces when using the V1 text-based protocol. The checkAddress method only verified the address length. This allowed the creation of an HAProxyMessage object with a malicious address string containing a CRLF sequence. Second, the HAProxyMessageEncoder.encodeV1 method, which serializes the HAProxyMessage to the wire format, blindly wrote the source and destination addresses to the output buffer. When a malicious address was provided, this resulted in the injection of a new PROXY protocol line, which could be used to spoof the client's IP address as seen by the downstream server. The patch addresses the root cause by adding validation within the HAProxyMessage.checkAddress method to reject AF_UNIX addresses containing CR, LF, or space characters when the protocol version is V1, thus preventing the creation of a malicious message in the first place.
io.netty.handler.codec.haproxy.HAProxyMessage.checkAddresscodec-haproxy/src/main/java/io/netty/handler/codec/haproxy/HAProxyMessage.java
io.netty.handler.codec.haproxy.HAProxyMessageEncoder.encodeV1codec-haproxy/src/main/java/io/netty/handler/codec/haproxy/HAProxyMessageEncoder.java
io.netty.handler.codec.haproxy.HAProxyMessage.<init>codec-haproxy/src/main/java/io/netty/handler/codec/haproxy/HAProxyMessage.java