HexBrain

U.S. Dept Of Defense · Report #1884372

HAProxy stats panel exposed externally

Validstatus
mediumseverity
8upvotes
24 Mar 2023disclosed

How it was found

Hi Team

I was able to find exposed web panel for HAProxy running on ████at port 1024

Impact

By visiting http://██████:1024/haproxy-status, the statistics page for HAProxy is shown. I have attached a screenshot to confirm that the endpoint is accessible externally ███

System Host(s)

████

Affected Product(s) and Version(s)

CVE Numbers

Steps to Reproduce

To Reproduce this simply visit http://███:1024/haproxy-status?stats http://███:1024/haproxy-status

Suggested Mitigation/Remediation Actions

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original