X-Forwarded-Prefix Header still allows for Open Redirect in traefik

Vulnerability

CVE-2024-52003 is an open redirect vulnerability in Traefik, an HTTP reverse proxy and load balancer. The root cause is an incomplete fix for a previously reported open redirect (GHSA-6qq8-5wq3-86rp) [3]. The safePrefix function, which validates the X-Forwarded-Prefix header, can be tricked into returning an absolute URL when the header contains certain payloads such as %0d//a.com or %2f%2fa.com [3]. This occurs because after URL parsing, the function returns only the path component, but an attacker can craft the header so that the parsed path is an absolute URL (e.g., //a.com) [3].

Exploitation

An attacker can exploit this by sending an HTTP request to a Traefik instance with a malicious X-Forwarded-Prefix header. For example, curl -v 'http://traefik.localhost' -H 'X-Forwarded-Prefix: %0d//a.com' results in a 302 redirect to //a.com/dashboard/ [3]. The attacker does not require authentication or special privileges; the vulnerability is triggered by any inbound HTTP request that reaches Traefik's API dashboard component [3]. The attack surface is limited to scenarios where Traefik is configured to trust the X-Forwarded-Prefix header from clients, as is common in reverse proxy deployments [1][2].

Impact

Successful exploitation allows an attacker to redirect users to an arbitrary external domain, which can be leveraged for phishing, credential theft, or other client-side attacks [3]. In cache poisoning scenarios, the open redirect may be further exploitable to poison web caches and deliver malicious content to multiple users [3]. The vulnerability does not directly compromise the Traefik server itself, but it undermines the integrity of the redirect functionality.

Mitigation

Traefik has released patched versions 2.11.14 and 3.2.1 that address this issue by dropping untrusted X-Forwarded-Prefix headers [1][4]. Users are strongly advised to upgrade to these or later versions [1]. There are no known workarounds for this vulnerability [1][3].