Incorrect processing of fragment in the URL leads to Authorization Bypass in Traefik

Vulnerability

Overview

CVE-2023-47106 describes a vulnerability in Traefik, an open-source HTTP reverse proxy and load balancer [2]. When Traefik receives a request containing a URL fragment (the part of a URI after #), it automatically URL-encodes and forwards that fragment to the backend server. This behavior violates RFC 7230 Section 5.3.1, which specifies that in origin-form, the request target should only contain the absolute path and query parameters, not the fragment [1].

Attack

Scenario

An attacker can exploit this by crafting a request with a URL fragment that, when passed through a frontend proxy such as Nginx, bypasses URI-based access control restrictions enforced by that frontend proxy [2]. For example, if Nginx is configured to block access to certain paths but does not strip fragments, Traefik's forwarding of the fragment may cause the backend to interpret the request differently, circumventing the intended restriction.

Impact

Successful exploitation allows an attacker to bypass access control policies set by a frontend proxy, gaining unauthorized access to protected resources or endpoints [2]. The impact is contingent on the presence of another frontend proxy that performs URI-based access control without properly handling fragments.

Mitigation

The vulnerability has been addressed in Traefik versions 2.10.6 and 3.0.0-beta5 [4]. Users are advised to upgrade to these or later versions. No known workarounds exist, making patching the only reliable mitigation [2].