Authentication Bypass in Traefik DigestAuth Middleware

Executive Summary

This vulnerability is an authentication bypass in Traefik's digestAuth middleware affecting versions before v2.11.55. When an unknown username is provided, the system returns an empty secret instead of rejecting the request. Attackers can exploit this by computing a valid digest response using the empty secret and arbitrary credentials to bypass authentication on any digestAuth-protected route without needing a valid username or password.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Traefik version is below 2.11.55 or 3.7.11. Run: traefik version. If using Docker, check the image tag with: docker inspect <container_name> | grep Image. Inspect Traefik configuration files for digestAuth middleware usage.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated remote attackers to gain unauthorized access to any route protected by digestAuth, including the Traefik dashboard and API. Exploitation requires only network access to the protected route and can be performed in two simple requests. It may also enable identity forgery or privilege escalation in trusted backends if the headerField option is configured.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthorized access to systems protected by digestAuth middleware, which could lead to unauthorized data exposure or modification. For GDPR, this may violate principles of data protection and user consent. For HIPAA, it could result in unauthorized access to protected health information, breaching security requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Traefik to version 2.11.55 or later for v2.x, or 3.7.11 or later for v3.x. If upgrading is not possible, disable the digestAuth middleware until patched. Monitor network traffic for unauthorized access attempts to digestAuth-protected routes.

Useful 0 Not Useful 0