Forward Header Injection in Traefik Reverse Proxy

Executive Summary

This vulnerability affects Traefik's ForwardAuth middleware in versions prior to v2.11.51, v3.6.22, and v3.7.6. Even when configured with trustForwardHeader set to false, the middleware incorrectly derives the X-Forwarded-Port header from the original incoming request instead of the sanitized forwarded request.

An unauthenticated remote attacker can exploit this by injecting an X-Forwarded-Proto: https header over a plain HTTP connection. This causes Traefik to forward X-Forwarded-Port: 443 to the authentication service, effectively bypassing port-based authorization checks.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring HTTP requests to your Traefik instance for the presence of the header "X-Forwarded-Proto: https" sent over plain HTTP connections. An attacker exploits this by injecting this header to cause Traefik to forward "X-Forwarded-Port: 443" to the authentication service, bypassing port-based authorization checks.

To detect potential exploitation attempts, you can capture and inspect HTTP traffic to your Traefik server and look for requests that include the header "X-Forwarded-Proto: https" while the connection itself is not encrypted (plain HTTP).

• Use tcpdump or tshark to capture HTTP traffic on the Traefik server port (usually 80):
• tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'
• Use tshark to filter HTTP requests containing the header "X-Forwarded-Proto: https":
• tshark -Y 'http.header contains "X-Forwarded-Proto: https"' -i <interface>
• Alternatively, check Traefik access logs or authentication service logs for requests where "X-Forwarded-Port" is set to 443 but the connection is not HTTPS.

Note that the vulnerability is fixed in Traefik versions v2.11.51, v3.6.22, and v3.7.6, so upgrading to these or later versions is recommended to prevent exploitation.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an unauthenticated remote attacker to bypass port-based authorization checks by manipulating headers. This can lead to unauthorized access to services that rely on Traefik's ForwardAuth middleware for authentication.

Such unauthorized access could compromise the security of applications behind the proxy, potentially exposing sensitive data or allowing further exploitation within the network.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an unauthenticated remote attacker to bypass port-based authorization checks by injecting an X-Forwarded-Proto: https header over a plain HTTP connection. This can lead to privilege escalation in environments where authentication services rely on the X-Forwarded-Port header for security decisions.

Such unauthorized access and privilege escalation could potentially lead to unauthorized data access or exposure, which may impact compliance with standards and regulations like GDPR or HIPAA that require strict access controls and protection of sensitive data.

However, the provided information does not explicitly detail the direct impact on compliance frameworks or specific regulatory requirements.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Traefik to one of the fixed versions: v2.11.51, v3.6.22, or v3.7.6.

Useful 0 Not Useful 0