Out-of-Bounds Write in OpenResty PROXY Protocol v2

Executive Summary

This vulnerability exists in OpenResty versions from 1.29.2.1 to before 1.29.2.5 in the implementation of the upstream PROXY protocol version 2. When OpenResty is configured to send PROXY protocol v2 headers to upstream servers, the construction of these headers can cause an out-of-bounds write beyond the allocated buffer. This means that the software writes data outside the memory area it should, which can cause the worker process to crash.

Only configurations that explicitly enable PROXY protocol v2 for upstream connections are affected by this issue. The vulnerability is fixed in OpenResty version 1.29.2.5.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability affects OpenResty versions from 1.29.2.1 to before 1.29.2.5 when configured to send PROXY protocol version 2 headers to upstream servers. Detection involves verifying the OpenResty version and checking if PROXY protocol v2 is enabled for upstream connections.

• Check the OpenResty version installed on your system using: `openresty -v` or `nginx -v` (if OpenResty is installed as nginx).
• Review your OpenResty configuration files (e.g., nginx.conf) for any directives enabling PROXY protocol v2 for upstream connections, such as `proxy_protocol on;` or similar settings in the upstream block.
• Monitor OpenResty worker processes for crashes or denial of service symptoms, which may indicate exploitation attempts.

Since no specific detection commands or tools are provided in the available information, these manual checks are recommended.

Useful 0 Not Useful 0

Impact Analysis

The primary impact of this vulnerability is a denial of service (DoS). Because the out-of-bounds write can cause the worker process to crash, the affected OpenResty server may become unavailable or unstable, disrupting service availability.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a denial of service by crashing the worker process due to an out-of-bounds write in the PROXY protocol v2 implementation. It does not impact confidentiality or integrity of data.

Since the vulnerability does not lead to data breaches or unauthorized data access, it does not directly affect compliance with data protection regulations such as GDPR or HIPAA.

However, denial of service incidents can impact availability, which may be a consideration under some regulatory frameworks depending on the context of use.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade OpenResty to version 1.29.2.5 or later, where the issue is fixed.

Additionally, review your OpenResty configuration and disable the use of PROXY protocol version 2 for upstream connections if it is not explicitly required.

Useful 0 Not Useful 0