CVE-2023-47106CWE-20

Incorrect processing of fragment in the URL leads to Authorization Bypass in Traefik

Medium · published December 4, 2023

CVSS v3.1
4.8
EPSS
1%
Percentile
49.3
In the wild
Unconfirmed
What it is

Traefik is an open source HTTP reverse proxy and load balancer. When a request is sent to Traefik with a URL fragment, Traefik automatically URL encodes and forwards the fragment to the backend server. This violates RFC 7230 because in the origin-form the URL should only contain the absolute path and the query. When this is combined with another frontend proxy like Nginx, it can be used to bypass frontend proxy URI-based access control restrictions. This vulnerability has been addressed in versions 2.10.6 and 3.0.0-beta5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00625 · 49.3th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2023-12-04T20:26Z
EPSS history
Timeline
  • 04 DEC 20:26Z
    Incorrect processing of fragment in the URL leads to Authorization Bypass in Traefik
    cvelistv5