Listen to this Post
Traefik canonicalizes HTTP header names by dashes only.
Therefore X-Auth-User, X_Auth_User, and X.Auth.User remain distinct inside Traefik.
Backends such as CGI, WSGI, PHP, and NGINX collapse these names into one variable.
That mismatch lets a client smuggle an alias of a Traefik-managed header.
The alias can bypass middleware that manages the canonical header.
ForwardAuth is the demonstrated case.
ForwardAuth removes the configured canonical identity header before copying the auth service value.
A client-supplied dot-form X.Authenticated.User survives this replacement.
It also survives underscoreHeadersStrategy: delete.
The tested PHP 8.2 built-in SAPI maps X-Authenticated-User and X.Authenticated.User to HTTP_X_AUTHENTICATED_USER.
In Traefik’s tested HTTP/1 backend path, the client value is serialized last.
It overrides the identity asserted by ForwardAuth.
A lower-privilege client permitted by ForwardAuth can be treated as another user or role.
At v3.7.10, pkg/server/server_entrypoint_tcp.go:800-818 removes or rejects only names containing _.
After successful authentication, pkg/middlewares/auth/forward.go:314-326 deletes and replaces only the canonical authResponseHeaders key.
The dot alias remains in req.Header.
The standard reverse proxy forwards both legal field names.
Go’s HTTP/1 writer sorts header names lexically.
It places X-Authenticated-User before X.Authenticated.User.
PHP collapses both into one $_SERVER key.
The attacker value deterministically wins.
This is an incomplete-fix sibling of GHSA-x677-9fxg-v5c5.
The published underscore input is blocked by the new entry-point strategy.
The dot input bypasses that mitigation on the current stable release.
The mitigation is the new aliasHeadersStrategy entry point option.
It defaults to keep for backwards compatibility.
It must be explicitly set to delete or reject to take effect.
Traefik v1.x, v2 up to v2.11.55, and v3.0.0 to v3.7.11 are affected.
Unmaintained lines will not receive their own patch.
Users should upgrade to v2.11.56 or v3.7.12 and set aliasHeadersStrategy.
Any header Traefik sets is exposed, not only ForwardAuth’s.
This report does not claim bypass of a ForwardAuth denial.
The auth service must first permit the request.
Runtime-verified with PHP 8.2.27 and 8.2.33.
Impact on other normalization-prone backends is conditional.
A permitted client may impersonate another user or administrative role.
Confidentiality and integrity are affected.
Observed on v3.7.10: admin.
Expected backend identity: lab-user.
The script verifies no alias, canonical header, and underscore alias produce lab-user.
DailyCVE Form:
Platform: Traefik
Version: v1.x v2.11.55 v3.7.11
Vulnerability : Header alias smuggling
Severity: Medium
date: Not Provided
Prediction: Patch date unavailable
(end of form)
What Undercode Say:
Analytics:
docker compose up -d bash verify.sh docker compose down
curl -H 'X.Authenticated.User: admin' http://127.0.0.1:18080/probe
GET /probe HTTP/1.1 Host: 127.0.0.1:18080 X.Authenticated.User: admin Connection: close
sed -n '800,818p' pkg/server/server_entrypoint_tcp.go sed -n '314,326p' pkg/middlewares/auth/forward.go
Expected backend identity:
lab-user
Observed on v3.7.10:
admin
Exploit: (Educational Purposes!)
GET /probe HTTP/1.1 Host: 127.0.0.1:18080 X.Authenticated.User: admin Connection: close
docker compose up -d bash verify.sh docker compose down
Protection: from this CVE
entryPoints: web: address: ":80" aliasHeadersStrategy: delete
entryPoints: web: address: ":80" aliasHeadersStrategy: reject
upgrade to v2.11.56 or v3.7.12
Impact:
Applications that authorize requests using a ForwardAuth-provided identity header can receive an attacker-selected username or role instead.
Runtime-verified with PHP 8.2.27 and 8.2.33; impact on other normalization-prone backends is conditional.
A lower-privilege permitted client may impersonate another user or administrative role, affecting confidentiality and integrity.
This report does not claim bypass of a ForwardAuth denial: the auth service must first permit the request.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
