GHSA-6qq8-5wq3-86rp

Source

https://github.com/advisories/GHSA-6qq8-5wq3-86rp

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-6qq8-5wq3-86rp/GHSA-6qq8-5wq3-86rp.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-6qq8-5wq3-86rp

Aliases

CVE-2020-15129

Related

CVE-2020-15129

Published

2022-02-11T23:19:21Z

Modified

2023-11-01T04:51:57.079901Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N CVSS Calculator

Summary

Traefik vulnerable to Open Redirect via handling of X-Forwarded-Prefix header

Details

Summary

There exists a potential open redirect vulnerability in Traefik's handling of the X-Forwarded-Prefix header. Active Exploitation of this issue is unlikely as it would require active header injection, however the Traefik team addressed this issue nonetheless to prevent abuse in e.g. cache poisoning scenarios.

Details

The Traefik API dashboard component doesn't validate that the value of the header X-Forwarded-Prefix is a site relative path and will redirect to any header provided URI.

e.g.

$ curl --header 'Host:traefik.localhost' --header 'X-Forwarded-Prefix:https://example.org' 'http://localhost:8081'
<a href="https://example.org/dashboard/">Found</a>.`

Impact

A successful exploitation of an open redirect can be used to entice victims to disclose sensitive information.

Workarounds

By using the headers middleware, the request header X-Forwarded-Prefix value can be overridden by the value . (dot)

https://docs.traefik.io/v2.2/middlewares/headers/#customrequestheaders
https://docs.traefik.io/v1.7/basics/#custom-headers

For more information

If you have any questions or comments about this advisory, open an issue in Traefik.

Credit

This issue was found by the GitHub Application Security Team and reported on behalf of the GHAS by the GitHub Security Lab Team.

Database specific

{
    "nvd_published_at": "2020-07-30T16:15:00Z",
    "github_reviewed_at": "2021-05-24T18:21:00Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-601"
    ]
}

References

Affected packages

Go / github.com/traefik/traefik

Package

Name: github.com/traefik/traefik; View open source insights on deps.dev
Purl: pkg:golang/github.com/traefik/traefik

Affected ranges

Type: SEMVER
Events: Introduced

1.5.0-rc5

Fixed

1.7.26

Go / github.com/traefik/traefik/v2

Package

Name: github.com/traefik/traefik/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/traefik/traefik/v2

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.3.0-rc6

Database specific

{
    "last_known_affected_version_range": "< 2.2.8"
}

Go / github.com/containous/traefik

Package

Name: github.com/containous/traefik; View open source insights on deps.dev
Purl: pkg:golang/github.com/containous/traefik

Affected ranges

Type: SEMVER
Events: Introduced

1.5.0-rc5

Fixed

1.7.26

Go / github.com/containous/traefik/v2

Package

Name: github.com/containous/traefik/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/containous/traefik/v2

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.2.8

Go / github.com/traefik/traefik/v2

Package

Name: github.com/traefik/traefik/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/traefik/traefik/v2

Affected ranges

Type: SEMVER
Events: Introduced

2.3.0-rc1

Fixed

2.3.0-rc6

Database specific

{
    "last_known_affected_version_range": "< 2.3.0-rc3"
}

Go / github.com/containous/traefik/v2

Package

Name: github.com/containous/traefik/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/containous/traefik/v2

Affected ranges

Type: SEMVER
Events: Introduced

2.3.0-rc1

Fixed

2.3.0-rc3

Go / github.com/traefik/traefik/api

Package

Name: github.com/traefik/traefik/api; View open source insights on deps.dev
Purl: pkg:golang/github.com/traefik/traefik/api

Affected ranges

Type: SEMVER
Events: Introduced

1.5.0-rc5

Fixed

1.7.26

Go / github.com/traefik/traefik/v2/pkg/api

Package

Name: github.com/traefik/traefik/v2/pkg/api; View open source insights on deps.dev
Purl: pkg:golang/github.com/traefik/traefik/v2/pkg/api

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.3.0-rc6

Database specific

{
    "last_known_affected_version_range": "< 2.2.8"
}

Go / github.com/traefik/traefik/v2/pkg/api

Package

Name: github.com/traefik/traefik/v2/pkg/api; View open source insights on deps.dev
Purl: pkg:golang/github.com/traefik/traefik/v2/pkg/api

Affected ranges

Type: SEMVER
Events: Introduced

2.3.0-rc1

Fixed

2.3.0-rc6

Database specific

{
    "last_known_affected_version_range": "< 2.3.0-rc3"
}

Go / github.com/containous/traefik/api

Package

Name: github.com/containous/traefik/api; View open source insights on deps.dev
Purl: pkg:golang/github.com/containous/traefik/api

Affected ranges

Type: SEMVER
Events: Introduced

1.5.0-rc5

Fixed

1.7.26

Go / github.com/containous/traefik/v2/pkg/api

Package

Name: github.com/containous/traefik/v2/pkg/api; View open source insights on deps.dev
Purl: pkg:golang/github.com/containous/traefik/v2/pkg/api

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.2.8

Go / github.com/containous/traefik/v2/pkg/api

Package

Name: github.com/containous/traefik/v2/pkg/api; View open source insights on deps.dev
Purl: pkg:golang/github.com/containous/traefik/v2/pkg/api

Affected ranges

Type: SEMVER
Events: Introduced

2.3.0-rc1

Fixed

2.3.0-rc3