Traefik HTTP Header X-Forwarded less trusted source

Summaryinfo

A vulnerability classified as critical was found in Traefik. Affected by this issue is some unknown functionality of the component HTTP Header Handler. Such manipulation of the argument X-Forwarded leads to less trusted source. This vulnerability is referenced as CVE-2024-45410. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Traefik (version unknown). It has been rated as critical. Affected by this issue is an unknown function of the component HTTP Header Handler. The manipulation of the argument X-Forwarded with an unknown input leads to a less trusted source vulnerability. Using CWE to declare the problem leads to CWE-348. The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Traefik is a golang, Cloud Native Application Proxy. When a HTTP request is processed by Traefik, certain HTTP headers such as X-Forwarded-Host or X-Forwarded-Port are added by Traefik before the request is routed to the application. For a HTTP client, it should not be possible to remove or modify these headers. Since the application trusts the value of these headers, security implications might arise, if they can be modified. For HTTP/1.1, however, it was found that some of theses custom headers can indeed be removed and in certain cases manipulated. The attack relies on the HTTP/1.1 behavior, that headers can be defined as hop-by-hop via the HTTP Connection header. This issue has been addressed in release versions 2.11.9 and 3.1.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2024-45410 since 08/28/2024. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

Upgrading eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Traefik

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion