Vulnerability · Published Jul 30, 2020 · Assigned by GitHub_M
CVE-2020-15129Open redirect in Traefik
Medium 6.1
In plain English
A medium-severity open redirect in traefik from containous. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 8.0% (higher than 95% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.
Official description
In Traefik before versions 1.7.26, 2.2.8, and 2.3.0-rc3, there exists a potential open redirect vulnerability in Traefik's handling of the "X-Forwarded-Prefix" header. The Traefik API dashboard component doesn't validate that the value of the header "X-Forwarded-Prefix" is a site relative path and will redirect to any header provided URI. Successful exploitation of an open redirect can be used to entice victims to disclose sensitive information. Active Exploitation of this issue is unlikely as it would require active header injection, however the Traefik team addressed this issue nonetheless to prevent abuse in e.g. cache poisoning scenarios.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | traefik | 2.2.8-r0 | ALPINE-CVE-2020-15129 |
| Alpine:v3.21 | traefik | 2.2.8-r0 | ALPINE-CVE-2020-15129 |
| Alpine:v3.22 | traefik | 2.2.8-r0 | ALPINE-CVE-2020-15129 |
| Alpine:v3.23 | traefik | 2.2.8-r0 | ALPINE-CVE-2020-15129 |
| Alpine:v3.24 | traefik | 2.2.8-r0 | ALPINE-CVE-2020-15129 |
| Go | github.com/containous/traefik | 1.7.26 | GHSA-6qq8-5wq3-86rp |
| Go | github.com/containous/traefik/api | 1.7.26 | GHSA-6qq8-5wq3-86rp |
| Go | github.com/containous/traefik/v2 | 2.2.8 | GHSA-6qq8-5wq3-86rp |
| Go | github.com/containous/traefik/v2 | 2.3.0-rc3 | GHSA-6qq8-5wq3-86rp |
| Go | github.com/containous/traefik/v2/pkg/api | 2.3.0-rc3 | GHSA-6qq8-5wq3-86rp |
| Go | github.com/containous/traefik/v2/pkg/api | 2.2.8 | GHSA-6qq8-5wq3-86rp |
| Go | github.com/traefik/traefik | 1.7.26 | GHSA-6qq8-5wq3-86rp |
| Go | github.com/traefik/traefik/api | 1.7.26 | GHSA-6qq8-5wq3-86rp |
| Go | github.com/traefik/traefik/v2 | 2.3.0-rc6 | GHSA-6qq8-5wq3-86rp |
| Go | github.com/traefik/traefik/v2 | 2.3.0-rc6 | GHSA-6qq8-5wq3-86rp |
| Go | github.com/traefik/traefik/v2/pkg/api | 2.3.0-rc6 | GHSA-6qq8-5wq3-86rp |
| Go | github.com/traefik/traefik/v2/pkg/api | 2.3.0-rc6 | GHSA-6qq8-5wq3-86rp |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| containous | traefik | < 1.7.26>= 2.0.0, < 2.2.8 |
Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N
References
- https://github.com/containous/traefik/security/advisories/GHSA-6qq8-5wq3-86rp x_refsource_CONFIRM
- https://github.com/containous/traefik/releases/tag/v1.7.26 x_refsource_MISC
- https://github.com/containous/traefik/releases/tag/v2.2.8 x_refsource_MISC
- https://github.com/containous/traefik/releases/tag/v2.3.0-rc3 x_refsource_MISC
- https://github.com/containous/traefik/pull/7109 x_refsource_MISC
- https://github.com/containous/traefik/commit/e63db782c11c7b8bfce30be4c902e7ef8f9f33d2 x_refsource_MISC