Traefik
CVE-2023-47106
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
Traefik is an open source HTTP reverse proxy and load balancer. When a request is sent to Traefik with a URL fragment, Traefik automatically URL encodes and forwards the fragment to the backend server. This violates RFC 7230 because in the origin-form the URL should only contain the absolute path and the query. When this is combined with another frontend proxy like Nginx, it can be used to bypass frontend proxy URI-based access control restrictions. This vulnerability has been addressed in versions 2.10.6 and 3.0.0-beta5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
AnalysisAI
Traefik is an open source HTTP reverse proxy and load balancer. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-20. Traefik is an open source HTTP reverse proxy and load balancer. When a request is sent to Traefik with a URL fragment, Traefik automatically URL encodes and forwards the fragment to the backend server. This violates RFC 7230 because in the origin-form the URL should only contain the absolute path and the query. When this is combined with another frontend proxy like Nginx, it can be used to bypass frontend proxy URI-based access control restrictions. This vulnerability has been addressed in versions 2.10.6 and 3.0.0-beta5. Users are advised to upgrade. There are no known workarounds for this vulnerability. Affected products include: Traefik.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Backend connection hijacking in Traefik reverse proxy (2.11.0 through 2.11.56 and 3.0.0 through 3.7.12) lets an unauthen
HTTP/1 request-target parsing in Traefik prior to 2.11.57 and 3.7.13 allows unauthenticated remote attackers to send a r
Route-level authentication bypass in Traefik v3.7.0-v3.7.7 allows unauthenticated remote attackers to reach backend endp
Traefik is an open source HTTP reverse proxy and load balancer. Rated high severity (CVSS 7.5), this vulnerability is re
types/types.go in Containous Traefik 1.7.x through 1.7.11, when the --api flag is used and the API is publicly reachable
Security middleware bypass in Traefik reverse proxy versions 2.11.26-2.11.56 and 3.4.2-3.7.12 allows unauthenticated net
Traefik's header-security defenses (aliasHeadersStrategy, underscoreHeadersStrategy, forwardedHeaders) inspect req.Heade
Traefik is an open source HTTP reverse proxy and load balancer. Rated medium severity (CVSS 6.5), this vulnerability is
Authentication bypass in Traefik v3.7.0 through v3.7.11 lets remote unauthenticated attackers reach protected Kubernetes
Authentication bypass in Traefik reverse proxy before v2.11.55 lets remote unauthenticated attackers defeat any route pr
Namespace confusion in Traefik's Kubernetes Gateway API provider (versions 3.7.0-3.7.6) enables a low-privileged route a
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today