GHSA-xf64-8mw2-4gr2: Traefik has a StripPrefix Route-Level Auth Bypass via Path Normalization
SummaryThere is a high severity vulnerability in Traefik's `StripPrefix` middleware that allows an unauthenticated attacker to bypass route-level authentication and authorization. When a public router matches on a `PathPrefix` rule and applies the `StripPrefix` middleware, a request path containing `..` or its percent-encoded form `%2e%2e` can match the public route at routing time and then, after the prefix is stripped and the path is normalized, resolve to a path served by a separate, authenticated router. As a result, an attacker can reach protected backend paths — such as admin or internal configuration endpoints — without satisfying the authentication middleware attached to the protected router.Patcheshttps://github.com/traefik/traefik/releases/tag/v2.11.48https://github.com/traefik/traefik/releases/tag/v3.6.19https://github.com/traefik/traefik/releases/tag/v3.7.3For more informationIf there are any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).Traefik StripPrefix Route-Level Auth Bypass via Path Normalization (/api../)SummaryA route-level authentication/authorization bypas was found in Traefik when `PathPrefix`-based public routes are combined with `StripPrefix`.A request using `/api../` or `/api%2e%2e/` can avoid protected router rules at the routing stage, but after `StripPrefix`, the path is normalized and forwarded to the backend as a protected path such as `/admin` or `/internal/config`.This is reproducible on patched/latest Traefik versions and appears related to, but distinct from, previously disclosed `StripPrefixRegex` / path-normalization issues.This report specifically affects `StripPrefix`.Affected Versions Tested| Image | Observed Version | Result |
|---|---|---|
| `traefik:v2.11` | `v2.11.46` | Affected |
| `traefik:v3.6` | `v3.6.17` | Affected |
| `traefik:latest` | `v3.7.1` | Affected |Lab Contrast| Image | Result |
|---|---|
| `traefik:v2.10` | Not reproduced in lab |
| `traefik:v3.5` | Not reproduced in lab |Vulnerable Configuration PatternThe issue appears when:a broad public route strips a prefixwhile a separate protected route is intended to guard internal/admin pathsObserved BehaviorDirect Protected PathsThese are correctly blocked.| Request | Expected | Observed |
|---|---|---|
| `GET /admin` | Blocked | `401` |
| `GET /internal/config` | Blocked | `401` |Expected Public ExclusionsThese do not expose protected backend paths.| Request | Expected | Observed |
|---|---|---|
| `GET /api/admin` | Not routed to protected backend path | `404` |
| `GET /api/internal/config` | Not routed to protected backend path | `404` |Bypass PayloadsThese reach protected backend paths.| Request | Observed Status | Backend Receives |
|---|---|---|
| `GET /api../admin` | `200` | `/admin` |
| `GET /api%2e%2e/admin` | `200` | `/admin` |
| `GET /api../internal/config` | `200` | `/internal/config` |
| `GET /api%2e%2e/internal/config` | `200` | `/internal/config` |Minimal PoCdocker-compose.ymldynamic.ymlbackend.pypoc.pyRunExpected Vulnerable OutputRoot Cause HypothesisThe vulnerable behavior appears to be caused by path normalization after prefix stripping.The request does not match the protected `/admin` router at the routing stage, but the backend receives `/admin` after normalization.The relevant behavior appears related to `StripPrefix` calling `req.URL.JoinPath()` after removing the prefix in newer versions.Security ImpactAn unauthenticated network attacker can bypass intended Traefik route-level authentication/authorization boundaries and access backend paths that the operator intended to protect with a separate protected router.Potential impact includes:Access to protected admin pathsAccess to internal configuration endpointsExposure of secrets returned by internal backendsAccess to protected backend management functionalityConditional RCE if the protected backend exposes an execution primitiveIn the local lab, a protected `/admin/exec` endpoint was reachable through `/api../admin/exec`, demonstrating a conditional RCE chain when the backend contains an execution primitive.This is not a standalone Traefik RCE claim. It is an authentication/authorization boundary bypass that can expose protected backend functionality.Suggested SeveritySuggested CVSS is **10.0 Critical** with Scope Changed, because the bypass crosses the Traefik route-level authorization boundary and exposes protected backend functionality.Scope Changed was selected because the request bypasses Traefik's route-level authorization boundary and reaches backend paths that are intended to be protected by a separate authenticated router.If the vendor treats Traefik and the backend as the same security scope, the score may be interpreted as **9.1 Critical** with Scope Unchanged:The issue was submitted with the stronger Scope Changed interpretation, but the maintainers may adjust the final CVSS score during triage.WeaknessPrimary CWE:`CWE-863: Incorrect Authorization`Related weakness candidates:`CWE-180: Incorrect Behavior Order: Validate Before Canonicalize``CWE-22: Improper Limitation of a Pathname to a Restricted Directory`Mitigation Verified in LabThe bypass was blocked when using a stricter prefix boundary:or:Relation to Existing AdvisoriesThis appears related to the same vulnerability family as prior Traefik path normalization / `StripPrefixRegex` bypass advisories, but it affects `StripPrefix` and remains reproducible on patched/latest versions tested above.This was reported as a possible incomplete fix or bypass variant rather than assuming it is a duplicate.ReporterWonYun / kyun0
CVSS v4.0: 7.8