Summary
A process-global authentication flaw in the HAProxy Data Plane API can disable Basic authentication on shared request handling when TLS settings include a certificate authority and numeric TLS port. If an HTTP or UNIX domain socket management listener remains reachable without mutual TLS enforcement, an attacker may obtain administrative API access without credentials.
A process-global authentication flaw in the HAProxy Data Plane API can disable Basic authentication on shared request handling when TLS settings include a certificate authority and numeric TLS port. If an HTTP or UNIX domain socket management listener remains reachable without mutual TLS enforcement, an attacker may obtain administrative API access without credentials.
Affected context
The issue can occur in HAProxy Data Plane API deployments that configure TLS certificate-authority and port settings while concurrently exposing multiple management transports. Because request handling is shared across HTTP, HTTPS, and UNIX domain socket listeners, authentication decisions intended for one transport may affect others, particularly where client-certificate verification is enforced only on the HTTPS path.
The issue can occur in HAProxy Data Plane API deployments that configure TLS certificate-authority and port settings while concurrently exposing multiple management transports. Because request handling is shared across HTTP, HTTPS, and UNIX domain socket listeners, authentication decisions intended for one transport may affect others, particularly where client-certificate verification is enforced only on the HTTPS path.
Exploit preconditions
- Attack surface: HAProxy Data Plane API management endpoints exposed through HTTP or UNIX domain sockets
- Required access: Network reachability to an affected HTTP endpoint or local access to an affected UNIX socket
- Trigger point: API request processing after the relevant TLS CA and numeric TLS port configuration is loaded
- Why exploitation is possible: Authentication state is maintained at process scope, while mutual TLS validation is applied only on the HTTPS server path, allowing other active listeners to operate without the expected credential checks
- Attack surface: HAProxy Data Plane API management endpoints exposed through HTTP or UNIX domain sockets
- Required access: Network reachability to an affected HTTP endpoint or local access to an affected UNIX socket
- Trigger point: API request processing after the relevant TLS CA and numeric TLS port configuration is loaded
- Why exploitation is possible: Authentication state is maintained at process scope, while mutual TLS validation is applied only on the HTTPS server path, allowing other active listeners to operate without the expected credential checks
Why this happens
The underlying defect is a mismatch between process-global authentication state and transport-specific security requirements. Configuring TLS-related values causes shared request handling to disable Basic authentication, while client-certificate verification remains limited to HTTPS connections. This maps to CWE-306: Missing Authentication for Critical Function, because administrative API operations can become available without validating the identity of the requester.
The underlying defect is a mismatch between process-global authentication state and transport-specific security requirements. Configuring TLS-related values causes shared request handling to disable Basic authentication, while client-certificate verification remains limited to HTTPS connections. This maps to CWE-306: Missing Authentication for Critical Function, because administrative API operations can become available without validating the identity of the requester.
Potential impact
- An attacker may obtain full administrative access to the Data Plane API
- Sensitive cleartext HAProxy configuration data could be disclosed
- Managed HAProxy configuration could be replaced or manipulated
- Traffic-routing, backend, or access-control behavior could be altered
- A compromised management endpoint could enable broader service or infrastructure impact
- An attacker may obtain full administrative access to the Data Plane API
- Sensitive cleartext HAProxy configuration data could be disclosed
- Managed HAProxy configuration could be replaced or manipulated
- Traffic-routing, backend, or access-control behavior could be altered
- A compromised management endpoint could enable broader service or infrastructure impact
General mitigation guidance
Mitigation generally focuses on making authentication and authorization decisions explicit for every request and transport.
Common defensive patterns include:
- Enforcing authentication independently on HTTP, HTTPS, and UNIX domain socket listeners
- Binding mutual TLS validation to the specific connection and request context rather than shared process state
- Disabling or isolating management listeners that are not required
- Restricting management interfaces to trusted networks and administrative identities
- Applying least privilege to API roles and separating read-only access from configuration-management operations
- Protecting sensitive configuration data and using secure-by-default listener settings
- Treating configuration endpoints as privileged administrative functions requiring explicit authorization
Mitigation generally focuses on making authentication and authorization decisions explicit for every request and transport.
Common defensive patterns include:
- Enforcing authentication independently on HTTP, HTTPS, and UNIX domain socket listeners
- Binding mutual TLS validation to the specific connection and request context rather than shared process state
- Disabling or isolating management listeners that are not required
- Restricting management interfaces to trusted networks and administrative identities
- Applying least privilege to API roles and separating read-only access from configuration-management operations
- Protecting sensitive configuration data and using secure-by-default listener settings
- Treating configuration endpoints as privileged administrative functions requiring explicit authorization
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis of shared handler state that changes authentication behavior globally
- Code review checks for transport-specific TLS validation combined with process-wide security flags
- Integration tests that exercise HTTP, HTTPS, and UNIX socket listeners concurrently
- Negative authorization tests confirming that every management transport rejects unauthenticated administrative requests
- Policy enforcement requiring authentication and least-privilege authorization on all management endpoints
- Audit-log analysis for administrative API activity without corresponding successful authentication events
Automated security testing and code-review tools may help identify inconsistent authentication enforcement across transports.
Organizations can look for this class of issue through:
- Static analysis of shared handler state that changes authentication behavior globally
- Code review checks for transport-specific TLS validation combined with process-wide security flags
- Integration tests that exercise HTTP, HTTPS, and UNIX socket listeners concurrently
- Negative authorization tests confirming that every management transport rejects unauthenticated administrative requests
- Policy enforcement requiring authentication and least-privilege authorization on all management endpoints
- Audit-log analysis for administrative API activity without corresponding successful authentication events
Automated security testing and code-review tools may help identify inconsistent authentication enforcement across transports.
