Traefik vulnerable to bypassing IP allow-lists via HTTP/3 early data requests in QUIC 0-RTT handshakes

Vulnerability

CVE-2024-39321 affects Traefik, an HTTP reverse proxy and load balancer. The vulnerability lies in how Traefik handles HTTP/3 early data requests sent during QUIC 0-RTT handshakes. Because the initial QUIC handshake and early data are transmitted in a single UDP datagram, the source IP address can be spoofed. The server processes the request before the handshake completes and before the client's IP address is validated, allowing an attacker to bypass IP-based allow-lists [1][2].

Exploitation

To exploit this, an attacker first establishes an HTTP/3 connection to the target Traefik instance using their real IP address and obtains a session ticket (no actual HTTP request is needed). The attacker then closes that connection and crafts a single UDP datagram containing a QUIC initial packet with the session ticket and a TLS ClientHello, a QUIC 0-RTT packet carrying early data encrypted with the pre-shared key, and an HTTP/3 request. This datagram is then sent with an arbitrarily spoofed source IP address. Because the request is processed before the handshake completes, Traefik sees the spoofed IP and may grant access to resources that should be restricted by its IP allow-list [1].

Impact

An attacker who can obtain a session ticket can effectively bypass IP allow-lists, potentially gaining unauthorized access to protected services. This could lead to exposure of internal applications, data exfiltration, or further lateral movement within the network, depending on what the allow-lists protect.

Mitigation

The vulnerability is fixed in Traefik versions 2.11.6, 3.0.4, and 3.1.0-rc3 [1][2]. No workarounds are available. Users running earlier versions should upgrade immediately. The issue is not known to be in CISA's Known Exploited Vulnerabilities catalog as of publication.