Threat Intelligence Database

Traefik versions v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11 have a header canonicalization issue where headers with dots, underscores, and dashes are treated as distinct. This allows an attacker to smuggle alternate forms of headers past Traefik's middleware, potentially causing backend services to use attacker-supplied header values instead of those asserted by Traefik. This can lead to privilege escalation or identity spoofing. The issue is fixed in v2.11.56 and v3.7.12 with a new configuration option that must be explicitly enabled to take effect. Unmaintained versions will not receive patches.

## Summary There is a high severity vulnerability in Traefik's Kubernetes Ingress NGINX provider. When an Ingress uses the `nginx.ingress.kubernetes.io/rewrite-target` annotation with a regular expression that captures attacker-controlled text without requiring a path separator (for example path `/api(.*)` with rewrite target `/$1`), the generated `RewriteTarget` middleware can turn an initially safe request path into a dot-segment traversal path after the router has already been selected. ## Patches - https://github.com/traefik/traefik/releases/tag/v3.7.8 ## For more information If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues). <details> <summary>Original Description</summary> ## Summary Traefik's Kubernetes Ingress NGINX provider creates an internal `RewriteTarget` middleware for the `nginx.ingress.kubernetes.io/rewrite-target` annotation. When an Ingress path captures attacker-controlled text without requiring a path separator, the middleware can turn an initially safe path into a dot-segment traversal path after Traefik has already selected the router. For example, with Ingress path `/api(.*)` and rewrite target `/$1`, an unauthenticated request to `/api../admin` follows this flow: 1. The default entry-point path sanitizer leaves `/api../admin` unchanged because `api..` is one ordinary segment. 2. The public router's `PathRegexp("(?i)^/api(.*)")` rule matches. 3. `RewriteTarget` captures `../admin` and creates `/../admin`. 4. The middleware forwards `/../admin` without checking whether path normalization changes it. 5. A backend that normalizes paths resolves `/../admin` to `/admin`. 6. The request reaches content intended to be reachable only through a separate `/admin` router with BasicAuth, DigestAuth, or ForwardAuth. This is an unpatched sibling of [GHSA-cxjq-mrr5-89rv](https://github.com/traefik/traefik/security/advisories/GHSA-cxjq-mrr5-89rv), which added post-replacement normalization validation to `ReplacePathRegex`. The separate ingress-nginx `RewriteTarget` implementation did not receive the same validation. The bypass remains exploitable in the patched Traefik v3.7.7 release. ## Severity **Proposed severity:** Critical **CVSS 3.1:** 9.1 — `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N` - Attack vector: Network - Attack complexity: Low once the affected routing pattern exists - Privileges required: None - User interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: None **Primary weakness:** CWE-22 — Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) **Secondary weakness:** CWE-288 — Authentication Bypass Using an Alternate Path or Channel The practical impact depends on the protected backend paths. If they are read-only or low sensitivity, environmental severity may be lower. ### Exploitation Preconditions - The Kubernetes Ingress NGINX provider is enabled. - A public Ingress uses `rewrite-target` with a regex that can capture `..` adjacent to the matched prefix, such as `/api(.*)` with `/$1`. - A protected router exposes another path on the same backend, such as `/admin`, and relies on a Traefik authentication or authorization middleware. - The backend normalizes dot segments before dispatching the request. These are deployment prerequisites; the remote attacker needs no credentials or special timing. ## Affected Components ### Confirmed versions - Traefik v3.7.0 through v3.7.7 - Current `master` at commit `b93f02cd07b79490fb8c8f02e301a7a1ec553195` - Current `v3.7` branch at `69259c3acc9d4bdc065cb2e3b83336f7de3e7038` The vulnerable middleware is present in every stable v3.7 release checked. The v2.11 and v3.6 branches do not contain this ingress-nginx `RewriteTarget` implementation. ### Code locations - `pkg/provider/kubernetes/ingress-nginx/middleware.go:257-274` - Converts the Ingress path and `rewrite-target` annotation directly into `dynamic.RewriteTarget` configuration. - `pkg/middlewares/ingressnginx/rewritetarget/rewrite_target.go:85-157` - Performs capture-based path rewriting and forwards the rewritten path without normalization validation. - `pkg/server/middleware/middlewares.go:346-353` - Instantiates the vulnerable middleware in the live HTTP chain. ## Root Cause The provider passes the route regex and annotation replacement into the middleware: ```go loc.RewriteTarget = &dynamic.RewriteTarget{ Regex: loc.Path, Replacement: rewrite, } ``` `RewriteTarget.ServeHTTP` then derives a path from attacker-controlled capture groups: ```go newTarget = rt.regexp.ReplaceAllString(currentPath, rt.replacement) req.URL.RawPath = newTarget req.URL.Path, err = url.PathUnescape(req.URL.RawPath) req.RequestURI = req.URL.RequestURI() rt.next.ServeHTTP(rw, req) ``` There is no invariant check between `PathUnescape` and forwarding to ensure that `req.URL.Path` equals its normalized form. Because routing happen