CVE-2025-46810
BaseFortify
Publication date: 2025-09-02
Last updated on: 2025-09-02
Assigner: SUSE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| suse | traefik2 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-61 | The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a privilege escalation issue in the traefik2 package on openSUSE Tumbleweed. It occurs because the package's post-installation script runs 'chown' commands as root on directories and files under /etc/traefik and /var/log/traefik that can be controlled by the traefik service user. A malicious user can create symbolic links pointing to critical system files like /etc/passwd. When the package is reinstalled, the 'chown' commands inadvertently change ownership of these critical files to the traefik user, allowing the attacker to escalate their privileges to root. [1]
How can this vulnerability impact me? :
This vulnerability can allow a user with limited privileges (the traefik service user) to gain root-level access on the system. This means an attacker could fully control the system, modify critical files, install malicious software, or disrupt system operations, leading to a complete compromise of the affected machine. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking for improper ownership of critical system files such as /etc/passwd that may have been changed to the traefik user. You can use commands like `ls -l /etc/passwd` to verify ownership. Additionally, inspecting symbolic links under /etc/traefik and /var/log/traefik for suspicious symlinks pointing to critical system files can help detect exploitation attempts. For example, use `find /etc/traefik -type l -ls` and `find /var/log/traefik -type l -ls` to list symbolic links. Checking package installation or update logs for chown operations on these directories may also help identify exploitation. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include manually correcting the ownership of critical system files and directories affected by the vulnerability, ensuring that parent directories are owned by root before package installation or updates. Specifically, change ownership of parent directories to root starting from the shortest path, then operate on files, and finally revert ownership of directories back to the service user starting from the longest path. Additionally, update the traefik2 package to the fixed version that removes the vulnerable code. Avoid running package installation or update scripts as the traefik user and monitor for suspicious symbolic links in /etc/traefik and /var/log/traefik. [1]