alexoarga/cve-2021-40346Proof-of-concept for CVE-2021-40346, demonstrating HTTP request smuggling in HAProxy via integer overflow, with Docker-based environment to bypass access controls.
Integer overflow on header request internal representation allows HTTP request smuggling. This repository presents a PoC built with docker-compose using two docker images: one with a vulnerable version of HaProxy (in this case 2.2.16) and one with a Flask web server using Gunicorn as WSGI. By exploiting the vulnerability we are able to access the /admin page, whose requests are blocked by HaProxy though a user-defined rule.
Run the followinf commands on terminal to bring up HaProxy docker container and Flask server image:
docker-compose up
Send the payload to HaProxy:
cat payload | nc localhost 8000
In order to bring it down run:
docker-compose down