ProxySQL PP1 Protocol Spoofing Allows Client Address Forgery

Executive Summary

ProxySQL versions 2.0.0 through 3.0.8 have a critical vulnerability where the MySQL frontend incorrectly parses the PROXY protocol v1 header when the protocol token is "UNKNOWN". According to the HAProxy PROXY protocol v1 specification, any address fields following the "UNKNOWN" token should be ignored because the proxy cannot determine the client identity. However, ProxySQL parses these address fields anyway using sscanf and writes the spoofed source IP address into the session's client address field.

This spoofed IP address is then used in the mysql_query_rules.client_addr predicate, which controls routing and access control lists (ACLs). Because the default configuration allows any TCP client to send PROXY protocol frames, an attacker can forge any source IP address they want. This enables them to bypass routing rules and ACLs, effectively impersonating trusted clients or internal applications.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including unauthorized access to sensitive databases and resources. An attacker who can reach the ProxySQL MySQL frontend port can spoof their source IP address to bypass access controls and routing rules.

• Bypass of access control lists (ACLs) that rely on client IP addresses.
• Circumvention of routing rules such as read-write splitting, per-application schema pinning, and query filtering.
• Potential privilege escalation by impersonating trusted internal clients or administrative IP ranges.
• Spoofed IP addresses may also affect audit logs and monitoring tools, leading to inaccurate tracking and detection.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for suspicious PROXY protocol v1 frames sent to the ProxySQL MySQL frontend port, especially those containing the "UNKNOWN" token followed by address fields.

Since the vulnerability involves spoofed source IP addresses in the PROXY protocol header, you can check ProxySQL logs or audit logs for unexpected or inconsistent client_addr values that do not match actual network source IPs.

Commands to detect this might include network packet captures on the ProxySQL frontend port to inspect incoming PROXY protocol frames, for example using tcpdump or Wireshark:

• tcpdump -i <interface> -s 0 -w proxysql_capture.pcap port <proxysql_mysql_frontend_port>
• Use Wireshark to open proxysql_capture.pcap and filter for PROXY protocol v1 frames containing the "UNKNOWN" token.

Additionally, reviewing ProxySQL query-rule logs or audit logs for client_addr values that do not correspond to known or expected IP addresses can help identify exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate and most effective mitigation is to upgrade ProxySQL to version 3.0.9 or later, where the vulnerability has been patched.

If upgrading immediately is not possible, consider restricting access to the ProxySQL MySQL frontend port to trusted IP addresses only, rather than allowing any TCP peer (the default mysql-proxy_protocol_networks = '*').

Additionally, review and tighten mysql_query_rules and ACL configurations to minimize the impact of any spoofed client_addr values.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in ProxySQL allows an attacker to spoof the client source IP address, which is used in access control lists (ACLs), routing rules, audit logs, and monitoring tools. This spoofing can lead to unauthorized access to privileged routes or resources, potentially exposing sensitive data or allowing privilege escalation.

Such unauthorized access and manipulation of client identity can undermine the integrity and confidentiality of data, which are critical requirements under common standards and regulations like GDPR and HIPAA. Specifically, the ability to bypass ACLs and routing rules may lead to unauthorized data access or modification, violating data protection and privacy obligations.

Therefore, this vulnerability poses a significant risk to compliance with these regulations by potentially enabling breaches of sensitive personal or health information through compromised access controls.

Useful 0 Not Useful 0