GHSA-wh89-7897-x99h Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address
Security Vulnerability Report: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address in Netty1. Vulnerability Summary| Field | Value |
|-------|-------|
| **Product** | Netty |
| **Version** | 4.2.12.Final (and all prior versions with codec-haproxy) |
| **Component** | `io.netty.handler.codec.haproxy.HAProxyMessageEncoder` |
| **Vulnerability Type** | CWE-93: Improper Neutralization of CRLF Sequences |
| **Impact** | HAProxy PROXY Protocol Injection / Client IP Spoofing |
| **CVSS 3.1 Score** | **7.5 (High)** |
| **CVSS 3.1 Vector** | `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N` |2. Affected Components`io.netty.handler.codec.haproxy.HAProxyMessageEncoder` — `encodeV1()` method (lines 63-77): writes `sourceAddress` and `destinationAddress` directly to output without CRLF validation`io.netty.handler.codec.haproxy.HAProxyMessage` — constructor `checkAddress()` validates IPv4/IPv6 format but **only checks length for AF_UNIX** (line 439)3. Vulnerability DescriptionNetty's HAProxy protocol encoder writes AF_UNIX socket addresses directly into the HAProxy V1 text protocol format **without validating for CRLF characters**. The V1 protocol uses CRLF (`\r\n`) as the line terminator, so CRLF characters in an address split the single PROXY header line into multiple lines, effectively injecting a second PROXY protocol header.Root Cause — EncoderRoot Cause — Insufficient Address ValidationIPv4 and IPv6 addresses are validated against format rules that implicitly reject CRLF. But **AF_UNIX addresses only check `length <= 108`** — any characters including CRLF are accepted.4. Exploitability PrerequisitesThis vulnerability is exploitable when:An application uses Netty's `HAProxyMessageEncoder` to construct HAProxy V1 protocol headersAF_UNIX (`UNIX_STREAM` or `UNIX_DGRAM`) addresses contain user-controlled inputThe encoded PROXY header is sent to a downstream server or load balancer**Affected use cases**:PROXY protocol relays that construct AF_UNIX messages from upstream dataLoad balancer integrations where socket paths come from configuration or external sourcesMulti-tenant proxies that dynamically construct PROXY headers5. Attack ScenarioClient IP Spoofing via Second PROXY Line Injection**Wire format sent to backend**:The backend receives **two PROXY lines**. Depending on implementation:HAProxy: may use the first line and ignore the secondOther implementations: may use the **second** line, treating the connection as TCP4 from `10.0.0.1`This enables **client IP spoofing** — the backend believes the client is `10.0.0.1` when it's not6. Proof of ConceptFull Runnable PoC Source Code (HAProxyUnixCRLFPoC.java)How to Compile and RunPoC Execution Output (Verified on Netty 4.2.12.Final)7. Remediation RecommendationsOption 1: Validate AF_UNIX Addresses for CRLFOption 2: Validate in Encoder8. References[HAProxy PROXY Protocol v1 Specification](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)[CWE-93: Improper Neutralization of CRLF Sequences](https://cwe.mitre.org/data/definitions/93.html)[GHSA-jq43-27x9-3v86: Netty SMTP Command Injection (same pattern)](https://github.com/netty/netty/security/advisories/GHSA-jq43-27x9-3v86)
CVSS v3.1 score: 5.5