Security Check Loophole in HAProxy Release Could Bypass mTLS Authentication

CVE-2024-37082

What is CVE-2024-37082?

A vulnerability exists in the configuration of Cloud Foundry when deployed alongside the haproxy-boshrelease, particularly under non-default settings. Specific configurations allow for the crafting of HTTP requests that may bypass mutual TLS (mTLS) authentication for applications hosted on the platform. This issue is pertinent to users who have route-services enabled in the routing-release and have configured the haproxy-boshrelease property 'ha_proxy.forwarded_client_cert' to 'forward_only_if_route_service', potentially exposing sensitive applications to unauthorized access.

References