PROXY Protocol Large-Scale Measurement

A Large-Scale Measurement Study of the PROXY Protocol and its Security Implications

· 2 min · 404 words

topic/papercomputer science/securitycomputer science/networking

Paper Summary | NDSS 2025 | Generated by Hermes Agent

Executive Summary: First Internet-scale measurement of HAProxy’s PROXY protocol reveals widespread misconfiguration: 170,000+ hosts accept PROXY protocol data from arbitrary sources over HTTP. 10,000+ servers vulnerable to access bypass via spoofed PROXY headers. The authors gained access to 500+ internal servers controlling IoT/smart-home devices (security cameras, window blinds, alarm systems). The PROXY protocol’s protocol-agnostic, Layer-4 nature makes this a cross-protocol threat affecting HTTP, SMTP, FTP, and more.

1. High-Level Overview

Reverse proxies (Cloudflare, Akamai, HAProxy) solve load balancing but obscure client IPs. HTTP’s X-Forwarded-For header mostly fixes this for web traffic. The PROXY protocol generalizes this to any TCP-based protocol by prepending a header after TCP handshake. The problem: many deployments trust PROXY headers from anyone — not just from their own proxy.

2. Core Vulnerability

The PROXY protocol header is sent immediately after TCP handshake, before protocol-specific negotiation. If a backend server accepts PROXY headers from arbitrary sources, an attacker can:

  1. Connect to the backend directly (bypassing the proxy)
  2. Send a spoofed PROXY header claiming to be from a trusted IP
  3. The backend treats the attacker as whitelisted/internal

3. Measurement Results

FindingCount
Hosts accepting PROXY from arbitrary sources (HTTP)170,000+
Servers vulnerable to access bypass10,000+
Internal IoT servers accessed500+
Scan scopeFull IPv4 address space

4. Real-World Impacts

  • Accessed IoT monitoring platforms controlling security cameras, window blinds, alarm systems
  • Bypassed DoS protections (attacker appears as internal/trusted client)
  • Cross-protocol: affects HTTP, SMTP, FTP, IMAP, and any TCP-based service
  • Leaked sensitive backend infrastructure information

5. Key Findings

  1. Default configurations are dangerous — PROXY protocol often enabled with no source validation
  2. Protocol-agnostic threat — unlike X-Forwarded-For (HTTP-only), PROXY works at Layer 4
  3. Internet-scale — not a niche issue; 170K+ exposed hosts
  4. Physical-world impact — accessed real IoT devices controlling physical environments

6. TL;DR

170K+ Internet hosts blindly trust PROXY protocol headers from anyone. Attackers bypass reverse proxies and DoS protections, gaining access to 500+ internal IoT servers. Fix: validate PROXY header sources.

Sources

  1. NDSS 2025 Paper (DOI): https://dx.doi.org/10.14722/ndss.2025.242247
  2. Authors: Stijn Pletinckx, Christopher Kruegel, Giovanni Vigna — UC Santa Barbara