Listen to this Post
The vulnerability exists because Traefik processes router matching rules (PathPrefix, Path, PathRegex) on the raw, undecoded HTTP request path. The backend service later receives the URL-decoded path. An attacker can submit a request with a URL-encoded forward slash (%2F) or other restricted characters (%00, %3B, %3F, %23). The router’s rule, for example PathPrefix('/admin/'), does not match the raw string admin%2F. This causes the request to be matched by a different, less restrictive route (e.g., a catch-all `PathPrefix(‘/’)` rule). The request is then forwarded to the backend with the decoded path (/admin/), bypassing the security middleware (like authentication or blocking rules) attached to the intended route. This is a path normalization discrepancy between the router matcher and the backend forwarder.
Platform: Traefik
Version: < v2.11.32, < v3.6.4
Vulnerability: Path Matching Bypass
Severity: Critical
date: 2025-01-24
Prediction: Patched 2025-01-24
What Undercode Say:
curl -X POST "http://target/%2freport_note"
[http.routers.blocked] rule = "PathPrefix(<code>/report_note</code>)" middlewares = ["block-access"] service = "flask-service" [http.middlewares.block-access.replacePathRegex] regex = "." replacement = "/blocked"
How Exploit:
Send request with encoded slash (%2F) or null byte (%00) in path to bypass middleware.
Protection from this CVE:
Upgrade to Traefik v2.11.32 or v3.6.4. Implement strict middleware on catch-all routes.
Impact:
Unauthorized access to admin endpoints, privilege escalation, security policy bypass.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
