Traefik before v2.11.52 Authentication Bypass via ReplacePathRegex
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.11.52, 3.6.23, 3.7.7
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-controlled path segments without a mandatory path separator (e.g. regex "^/api(.*)", replacement "/$1"), the middleware forwards the replaced path to the backend without validating that it matches its normalized form. An unauthenticated remote attacker can send a crafted request (e.g. GET /api../admin) that produces an un-normalized path such as /../admin, which a backend that normalizes paths resolves to a protected route, bypassing authentication middleware. Fixed in v2.11.52, v3.6.23, and v3.7.7.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- traefik traefik
fixed in 2.11.52
- traefik traefik
From 3.6.0 · fixed in 3.6.23
- traefik traefik
From 3.7.0 · fixed in 3.7.7
- github.com/traefik/traefik/v2Go
fixed in 2.11.52
- github.com/traefik/traefik/v3Go
fixed in 3.6.23
- github.com/traefik/traefik/v3Go
From 3.7.0 · fixed in 3.7.7
- github.com/traefik/traefikGo
through 1.7.34
- github.com/traefik/traefikGo
All versions
- github.com/traefik/traefik/v3Go
fixed in 3.6.23; From 3.7.0 · fixed in 3.7.7