1 line
4.9 KiB
JSON
1 line
4.9 KiB
JSON
{"schema_version":"1.9.0","id":"GHSA-gm3x-23wp-hc2c","published":"2025-12-08T16:42:30Z","modified":"2026-04-16T02:14:32.835255100Z","aliases":["CVE-2025-66490","GO-2025-4206"],"summary":"Path Normalization Bypass in Traefik Router + Middleware Rules","details":"## Impact\n\nThere is a potential vulnerability in Traefik managing the requests using a `PathPrefix`, `Path` or `PathRegex` matcher.\n\nWhen Traefik is configured to route the requests to a backend using a matcher based on the path; if the request path contains an encoded restricted character from the following set **('/', '\\', 'Null', ';', '?', '#')**, it’s possible to target a backend, exposed using another router, by-passing the middlewares chain.\n\n## Example\n\n```yaml\napiVersion: traefik.io/v1alpha1\nkind: IngressRoute\nmetadata:\n name: my-service\nspec:\n routes:\n - match: PathPrefix(‘/admin/’)\n kind: Rule\n services:\n - name: service-a\n port: 8080\n middlewares:\n - name: my-security-middleware\n - match: PathPrefix(‘/’)\n kind: Rule\n services:\n - name: service-a\n port: 8080\n```\n\nIn such a case, the request `http://mydomain.example.com/admin%2F` will reach the backend `service-a` without operating the middleware `my-security-middleware` and passing the security put in place for the `/admin/` path.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.32\n- https://github.com/traefik/traefik/releases/tag/v3.6.4\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).\n\n<details>\n<summary>Original Description</summary>### Summary\nA vulnerability exists in Traefik’s path matching logic that allows attackers to bypass access-control middleware (e.g., blocking rules) by using URL-encoded paths. I found this vulnerability while playing PwnSec CTF 2025 with my team @0xL4ugh\n\n### Details\nTraefik evaluates router rules before decoding or normalizing the request path, but forwards the request after decoding to the backend service. As a result, routes meant to block access to sensitive endpoints (such as internal, beta, or admin endpoints) can be trivially bypassed.\n\n### PoC\nTraefik configuration used in this issue :\n```[http.routers.flask-router-report-deny]\n entryPoints = [\"web\"]\n rule = \"PathPrefix(`/report_note`)\"\n priority = 10\n middlewares = [\"block-access\"]\n service = \"flask-service\"\n\n[http.middlewares.block-access.replacePathRegex]\n regex = \".*\"\n replacement = \"/blocked\"\n```\nThe intention is to block all access to /report_note.\n\nHowever, the following request bypasses the block:\n```\nPOST /%2freport_note HTTP/1.1\nHost: localhost:62814\n\n\n```\n### Impact\nAccess Control Bypass:\nAny endpoint intended to be blocked (e.g., admin/debug/beta APIs) can be accessed by URL-encoding slashes or other characters.\n\nThis could lead to:\n\n- Unauthorized access to restricted endpoints\n- Execution of protected internal functionality\n- Potential privilege escalation\n- Bypass of security policies enforced via Traefik routing rules\n</details>","affected":[{"package":{"name":"github.com/traefik/traefik","ecosystem":"Go","purl":"pkg:golang/github.com/traefik/traefik"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"1.7.34"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-gm3x-23wp-hc2c/GHSA-gm3x-23wp-hc2c.json"}},{"package":{"name":"github.com/traefik/traefik/v2","ecosystem":"Go","purl":"pkg:golang/github.com/traefik/traefik/v2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.11.32"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-gm3x-23wp-hc2c/GHSA-gm3x-23wp-hc2c.json"}},{"package":{"name":"github.com/traefik/traefik/v3","ecosystem":"Go","purl":"pkg:golang/github.com/traefik/traefik/v3"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.6.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-gm3x-23wp-hc2c/GHSA-gm3x-23wp-hc2c.json"}}],"references":[{"type":"WEB","url":"https://github.com/traefik/traefik/security/advisories/GHSA-gm3x-23wp-hc2c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66490"},{"type":"PACKAGE","url":"https://github.com/traefik/traefik"},{"type":"WEB","url":"https://github.com/traefik/traefik/releases/tag/v2.11.32"},{"type":"WEB","url":"https://github.com/traefik/traefik/releases/tag/v3.6.4"}],"database_specific":{"cwe_ids":["CWE-436"],"github_reviewed":true,"github_reviewed_at":"2025-12-08T16:42:30Z","nvd_published_at":"2025-12-09T01:16:55Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}]} |