CVE-2020-15129
published 2020-07-30CVE-2020-15129: In Traefik before versions 1.7.26, 2.2.8, and 2.3.0-rc3, there exists a potential open redirect vulnerability in Traefik's handling of the "X-Forwarded-Prefix"…
PriorityP334medium4.7CVSS 3.1
AVNACHPRNUIRSCCLILAN
EXPLOIT
EPSS
8.01%
94.0th percentile
In Traefik before versions 1.7.26, 2.2.8, and 2.3.0-rc3, there exists a potential open redirect vulnerability in Traefik's handling of the "X-Forwarded-Prefix" header. The Traefik API dashboard component doesn't validate that the value of the header "X-Forwarded-Prefix" is a site relative path and will redirect to any header provided URI. Successful exploitation of an open redirect can be used to entice victims to disclose sensitive information. Active Exploitation of this issue is unlikely as it would require active header injection, however the Traefik team addressed this issue nonetheless to prevent abuse in e.g. cache poisoning scenarios.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| containous | traefik | < 1.7.26 | 1.7.26 |
| containous | traefik | — | — |
| github.com | containous_traefik | >= 1.5.0-rc5 < 1.7.26 | 1.7.26 |
| github.com | containous_traefik_api | >= 1.5.0-rc5 < 1.7.26 | 1.7.26 |
| github.com | containous_traefik_v2 | >= 0 < 2.2.8 | 2.2.8 |
| github.com | containous_traefik_v2 | >= 2.3.0-rc1 < 2.3.0-rc3 | 2.3.0-rc3 |
| github.com | containous_traefik_v2_pkg_api | >= 0 < 2.2.8 | 2.2.8 |
| github.com | containous_traefik_v2_pkg_api | >= 2.3.0-rc1 < 2.3.0-rc3 | 2.3.0-rc3 |
| github.com | traefik_traefik | >= 1.5.0-rc5 < 1.7.26 | 1.7.26 |
| github.com | traefik_traefik_api | >= 1.5.0-rc5 < 1.7.26 | 1.7.26 |
| github.com | traefik_traefik_v2 | >= 0 < 2.3.0-rc6 | 2.3.0-rc6 |
| github.com | traefik_traefik_v2 | >= 2.3.0-rc1 < 2.3.0-rc6 | 2.3.0-rc6 |
| github.com | traefik_traefik_v2_pkg_api | >= 0 < 2.3.0-rc6 | 2.3.0-rc6 |
| github.com | traefik_traefik_v2_pkg_api | >= 2.3.0-rc1 < 2.3.0-rc6 | 2.3.0-rc6 |
| traefik | traefik | < 1.7.26 | 1.7.26 |
| traefik | traefik | — | — |
| traefik | traefik | >= 2.2.0 < 2.2.8 | 2.2.8 |
Detection & IOCsextracted from sources · hover to see the quote
- →Send a GET request to the Traefik base URL with the header 'X-Forwarded-Prefix: https://foo.nl' and look for an HTTP 302 response with body containing 'Found' — this confirms the open redirect is exploitable. ↗
- →The vulnerability is in the Traefik API dashboard component, which does not validate that the 'X-Forwarded-Prefix' header value is a site-relative path, allowing redirect to any attacker-supplied URI. ↗
- →Identify exposed Traefik instances via Shodan (http.title:"traefik"), FOFA (title="traefik"), or Google (intitle:"traefik") for mass scanning of potentially vulnerable endpoints. ↗
- ·Exploitation requires active injection of the X-Forwarded-Prefix header, making opportunistic mass exploitation less likely; however, cache poisoning scenarios remain a concern. ↗
- ·Affected versions are Traefik before 1.7.26, 2.2.8, and 2.3.0-rc3. The nuclei template targets only the base URL (max-request: 1), so deeper path coverage may be needed in complex deployments. ↗
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.0MEDIUMAV:N/AC:H/Au:N/C:P/I:P/A:N
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Traefik vulnerable to Open Redirect via handling of X-Forwarded-Prefix header
ghsa·2022-02-11
CVE-2020-15129 [MEDIUM] CWE-601 Traefik vulnerable to Open Redirect via handling of X-Forwarded-Prefix header
Traefik vulnerable to Open Redirect via handling of X-Forwarded-Prefix header
## Summary
There exists a potential open redirect vulnerability in Traefik's handling of the `X-Forwarded-Prefix` header. Active Exploitation of this issue is unlikely as it would require active header injection, however the Traefik team addressed this issue nonetheless to prevent abuse in e.g. cache poisoning scenarios.
## Details
The Traefik API dashboard component doesn't validate that the value of the header `X-Forwarded-Prefix` is a site relative path and will redirect to any header provided URI.
e.g.
```
$ curl --header 'Host:traefik.localhost' --header 'X-Forwarded-Prefix:https://example.org' 'http://localhost:8081'
Found.`
```
### Impact
A successful exploitation of an open redirect can be used to
OSV
Traefik vulnerable to Open Redirect via handling of X-Forwarded-Prefix header
osv·2022-02-11
CVE-2020-15129 [MEDIUM] Traefik vulnerable to Open Redirect via handling of X-Forwarded-Prefix header
Traefik vulnerable to Open Redirect via handling of X-Forwarded-Prefix header
## Summary
There exists a potential open redirect vulnerability in Traefik's handling of the `X-Forwarded-Prefix` header. Active Exploitation of this issue is unlikely as it would require active header injection, however the Traefik team addressed this issue nonetheless to prevent abuse in e.g. cache poisoning scenarios.
## Details
The Traefik API dashboard component doesn't validate that the value of the header `X-Forwarded-Prefix` is a site relative path and will redirect to any header provided URI.
e.g.
```
$ curl --header 'Host:traefik.localhost' --header 'X-Forwarded-Prefix:https://example.org' 'http://localhost:8081'
Found.`
```
### Impact
A successful exploitation of an open redirect can be used to
No detection rules found.
Nuclei
Traefik - Open Redirect
nuclei·CVSS 4.7
CVE-2020-15129 [MEDIUM] Traefik - Open Redirect
Traefik - Open Redirect
Traefik before 1.7.26, 2.2.8, and 2.3.0-rc3 contains an open redirect vulnerability in the X-Forwarded-Prefix header. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
Template:
id: CVE-2020-15129
info:
name: Traefik - Open Redirect
author: dwisiswant0
severity: medium
description: Traefik before 1.7.26, 2.2.8, and 2.3.0-rc3 contains an open redirect vulnerability in the X-Forwarded-Prefix header. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
impact: |
An attacker can manipulate the redirect URL and trick users into visiting malicious websites.
remediation: |
Apply
No writeups or analysis indexed.
https://github.com/containous/traefik/commit/e63db782c11c7b8bfce30be4c902e7ef8f9f33d2https://github.com/containous/traefik/pull/7109https://github.com/containous/traefik/releases/tag/v1.7.26https://github.com/containous/traefik/releases/tag/v2.2.8https://github.com/containous/traefik/releases/tag/v2.3.0-rc3https://github.com/containous/traefik/security/advisories/GHSA-6qq8-5wq3-86rphttps://github.com/containous/traefik/commit/e63db782c11c7b8bfce30be4c902e7ef8f9f33d2https://github.com/containous/traefik/pull/7109https://github.com/containous/traefik/releases/tag/v1.7.26https://github.com/containous/traefik/releases/tag/v2.2.8https://github.com/containous/traefik/releases/tag/v2.3.0-rc3https://github.com/containous/traefik/security/advisories/GHSA-6qq8-5wq3-86rp
2020-07-30
Published