Unaudited HAProxy proxy-protocol trust enables client IP spoofing

Server listeners enable proxy protocol handling and prefer its source address metadata, which lets a direct client impersonate another IP address if the listener is reachable without a trusted load balancer in front of it.

Attacker-Controlled Source

The HAProxy protocol preface and embedded source address supplied on the inbound TCP stream.

Dangerous Sink

Channel source-address attributes overwritten from the decoded HAProxy message and reused as the canonical client IP.

Impact

• IP-based rate limiting and abuse controls can be bypassed.
• Audit logs and telemetry can attribute requests to a forged source.
• Downstream services can receive a spoofed X-Forwarded-For value.

Exploit Preconditions

The attacker can connect directly to a Zuul listener that is configured for proxy protocol instead of only through a trusted intermediary.

Recommended fix

Default proxy protocol support to disabled on public listeners. Enable it only on explicitly trusted load-balancer entry points, or reject proxy-protocol frames unless the immediate peer IP belongs to a configured trusted network.