CVE-2023-47106
published 2023-12-04CVE-2023-47106: Traefik is an open source HTTP reverse proxy and load balancer. When a request is sent to Traefik with a URL fragment, Traefik automatically URL encodes and…
PriorityP338medium6.5CVSS 3.1
AVNACLPRNUINSUCLILAN
EPSS
0.63%
45.4th percentile
Traefik is an open source HTTP reverse proxy and load balancer. When a request is sent to Traefik with a URL fragment, Traefik automatically URL encodes and forwards the fragment to the backend server. This violates RFC 7230 because in the origin-form the URL should only contain the absolute path and the query. When this is combined with another frontend proxy like Nginx, it can be used to bypass frontend proxy URI-based access control restrictions. This vulnerability has been addressed in versions 2.10.6 and 3.0.0-beta5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | traefik_traefik_v2 | >= 0 < 2.10.6 | 2.10.6 |
| github.com | traefik_traefik_v3 | >= 0 < 3.0.0-beta5 | 3.0.0-beta5 |
| traefik | traefik | < 2.10.6 | 2.10.6 |
| traefik | traefik | <= 2.10.5 | — |
| traefik | traefik | — | — |
| traefik | traefik | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Traefik incorrectly processes fragment in the URL, leads to Authorization Bypass in github.com/traefik/traefik
osv·2024-08-21
CVE-2023-47106 Traefik incorrectly processes fragment in the URL, leads to Authorization Bypass in github.com/traefik/traefik
Traefik incorrectly processes fragment in the URL, leads to Authorization Bypass in github.com/traefik/traefik
Traefik incorrectly processes fragment in the URL, leads to Authorization Bypass in github.com/traefik/traefik
GHSA
Traefik incorrectly processes fragment in the URL, leads to Authorization Bypass
ghsa·2023-12-05
CVE-2023-47106 [MEDIUM] CWE-177 Traefik incorrectly processes fragment in the URL, leads to Authorization Bypass
Traefik incorrectly processes fragment in the URL, leads to Authorization Bypass
### Summary
When a request is sent to Traefik with a URL fragment, Traefik automatically URL encodes and forwards the fragment to the backend server. This violates the RFC because in the origin-form the URL should only contain the absolute path and the query.
When this is combined with another frontend proxy like Nginx, it can be used to bypass frontend proxy URI-based access control
restrictions.
### Details
For example, we have this Nginx configuration:
```
location /admin {
deny all;
return 403;
}
```
This can be bypassed when the attacker is requesting to /#/../admin
This won’t be vulnerable if the backend server follows the RFC and ignores any characters after the fragment.
However, if Nginx is chai
OSV
Traefik incorrectly processes fragment in the URL, leads to Authorization Bypass
osv·2023-12-05
CVE-2023-47106 [MEDIUM] Traefik incorrectly processes fragment in the URL, leads to Authorization Bypass
Traefik incorrectly processes fragment in the URL, leads to Authorization Bypass
### Summary
When a request is sent to Traefik with a URL fragment, Traefik automatically URL encodes and forwards the fragment to the backend server. This violates the RFC because in the origin-form the URL should only contain the absolute path and the query.
When this is combined with another frontend proxy like Nginx, it can be used to bypass frontend proxy URI-based access control
restrictions.
### Details
For example, we have this Nginx configuration:
```
location /admin {
deny all;
return 403;
}
```
This can be bypassed when the attacker is requesting to /#/../admin
This won’t be vulnerable if the backend server follows the RFC and ignores any characters after the fragment.
However, if Nginx is chai
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://datatracker.ietf.org/doc/html/rfc7230#section-5.3.1https://github.com/traefik/traefik/releases/tag/v2.10.6https://github.com/traefik/traefik/releases/tag/v3.0.0-beta5https://github.com/traefik/traefik/security/advisories/GHSA-fvhj-4qfh-q2hmhttps://datatracker.ietf.org/doc/html/rfc7230#section-5.3.1https://github.com/traefik/traefik/releases/tag/v2.10.6https://github.com/traefik/traefik/releases/tag/v3.0.0-beta5https://github.com/traefik/traefik/security/advisories/GHSA-fvhj-4qfh-q2hm
2023-12-04
Published