haproxy-status-info-leak: HAProxy status 负载均衡状态

日期: 2025-09-01 | 影响软件: haproxy | POC: 已公开

漏洞描述

前端负载均衡，监控后端状态，高可用。 Dork to find system info leaks using haproxy stats. Google Search: inurl:haproxy-status site:example.com

PoC代码[已公开]

id: haproxy-status-info-leak

info:
  name: HAProxy status 负载均衡状态
  author: 不动明王
  severity: medium
  verified: true
  description: |
    前端负载均衡，监控后端状态，高可用。
    Dork to find system info leaks using haproxy stats.
    Google Search: inurl:haproxy-status site:example.com
  reference:
    - https://www.cnblogs.com/yinzhengjie/p/12147925.html
    - https://www.exploit-db.com/ghdb/4191
rules:
  r0:
    request:
      method: GET
      path: /haproxy-status
    expression: response.status == 200 && response.body.bcontains(b'General process information')
  r1:
    request:
      method: GET
      path: /haproxy?stats
    expression: response.status == 200 && response.body.bcontains(b'General process information')
expression: r0() || r1()
来源: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/disclosure/haproxy-status-info-leak.yaml

相关漏洞推荐