Listen to this Post
The vulnerability exists in Traefik’s handling of the ACME TLS-ALPN-01 challenge, a protocol for automatic TLS certificate issuance. When a client connects and sends a TLS ClientHello message containing the special `acme-tls/1` Application-Layer Protocol Negotiation (ALPN) string, Traefik intercepts this connection on a specific “fast path” to perform the certificate validation handshake. The critical flaw is in the `acmeTLSALPNHandler()` function within pkg/server/router/tcp/router.go. Before entering this handler, the code clears any existing network read/write deadlines on the TCP connection (conn.SetDeadline(time.Time{})). The handler then creates a TLS server instance and calls `Handshake()` without setting any new deadlines or ensuring the connection closes afterward. This creates an indefinite blocking operation. A malicious actor can exploit this by opening numerous connections, sending the initial ClientHello with the `acme-tls/1` marker, and then simply stopping all communication. Each of these stalled connections permanently consumes a goroutine (a lightweight thread) and a file descriptor. By exhausting these finite system resources, the Traefik entrypoint becomes unable to accept new legitimate connections, leading to a complete Denial of Service (DoS).
Platform: Traefik
Version: < v2.11.35, < v3.6.7
Vulnerability: Resource exhaustion DoS
Severity: High
date: 2024-12-17
Prediction: Patched 2024-12-17
What Undercode Say:
Simulate a hanging connection to the ACME-TLS/1 port (default 443) nc -z target.example.com 443 & Check for accumulated connections in SYN_RECV or ESTABLISHED state ss -tpn | grep traefik | head -20 Monitor Traefik logs for handshake errors post-patch journalctl -u traefik -f | grep -i "acme.handshake"
// Malicious ClientHello snippet (conceptual)
clientHello = []byte{
0x16, 0x03, 0x01, 0x00, 0x50, // TLS Header
// ... bytes containing ALPN extension with "acme-tls/1"
}
How Exploit:
An attacker writes a script to establish thousands of TCP connections to the Traefik entrypoint. For each connection, it sends a minimally crafted TLS ClientHello record that advertises the `acme-tls/1` protocol in the ALPN extension. Immediately after sending this packet, the script ceases to send any more data, leaving the handshake incomplete. The Traefik server, having cleared deadlines and lacking a timeout, waits indefinitely for the next step. Resources are consumed until the service is unreachable.
Protection from this CVE:
Upgrade to Traefik v2.11.35, v3.6.7, or any subsequent version. The patch modifies the `acmeTLSALPNHandler()` to wrap the `HandshakeContext()` call with a 2-second timeout using `context.WithTimeout` and ensures the connection is closed with defer tlsConn.Close(). Do not disable ACME TLS-ALPN challenges unless necessary. If using a reverse proxy in front of Traefik, consider rate-limiting connections to the challenge port.
Impact:
The impact is a reliable Denial of Service (DoS) against the affected Traefik entrypoint(s). It leads to exhaustion of goroutines and file descriptors, causing the proxy to stop accepting new connections. Service availability is fully compromised. No data confidentiality or integrity is breached. The attack requires no authentication and is low in complexity, with the only precondition being that the ACME TLS-ALPN challenge is enabled (which is common for automatic HTTPS).
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
