Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does not call service.AddTransportOnContext, so kerberosRoundTripper uses a shared backend transport instead of a transport dedicated to each frontend connection. With HTTP/3 enabled, a backend using connection-bound NTLM or Negotiate authentication, and backend keep-alive, an unrelated client can reuse a backend connection authenticated for a victim, read victim-only data, and act as that victim without the victim credentials.
This issue is fixed in 2.11.57 and 3.7.13.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 2
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Traefik Traefik
cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*
|
2.8.2
|
2.11.56
|
|
Traefik Traefik
cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*
|
3.0.0
|
3.7.12
|
References 5
https://github.com/traefik/traefik/commit/ff39c47d7459dec9cd8de63c1a4e7aa7315bd…
security-advisories@github.com
https://github.com/traefik/traefik/pull/13812
security-advisories@github.com
https://github.com/traefik/traefik/releases/tag/v2.11.57
security-advisories@github.com
https://github.com/traefik/traefik/releases/tag/v3.7.13
security-advisories@github.com
https://github.com/traefik/traefik/security/advisories/GHSA-qqjf-53cj-pwvv
security-advisories@github.com