3 known bugs in github.com/containous/traefik, with affected versions, fixes and workarounds. Sourced from upstream issue trackers.
| Severity | Affected | Fixed in | Title | Status | Source |
|---|---|---|---|---|---|
| medium | any | 2.1.4 | Improper Certificate Handling in github.com/containous/traefik Improper Certificate Handling in github.com/containous/traefik | fixed | osv:GO-2022-0808 |
| medium | any |
Get this data programmatically \u2014 free, no authentication.
curl https://depscope.dev/api/bugs/go/github.com/containous/traefik| 2.2.2 |
Improper Authentication in github.com/containous/traefik Improper Authentication in github.com/containous/traefik |
| fixed |
| osv:GO-2022-0774 |
| medium | 1.5.0-rc5 | 1.7.26 | Traefik vulnerable to Open Redirect via handling of X-Forwarded-Prefix header ## Summary
There exists a potential open redirect vulnerability in Traefik's handling of the `X-Forwarded-Prefix` header. Active Exploitation of this issue is unlikely as it would require active header injection, however the Traefik team addressed this issue nonetheless to prevent abuse in e.g. cache poisoning scenarios.
## Details
The Traefik API dashboard component doesn't validate that the value of the header `X-Forwarded-Prefix` is a site relative path and will redirect to any header provided URI.
e.g.
```
$ curl --header 'Host:traefik.localhost' --header 'X-Forwarded-Prefix:https://example.org' 'http://localhost:8081'
<a href="https://example.org/dashboard/">Found</a>.`
```
### Impact
A successful exploitation of an open redirect can be used to entice victims to disclose sensitive information.
### Workarounds
By using the `headers` middleware, the request header `X-Forwarded-Prefix` value can be overridden by the value `.` (dot)
- https://docs.traefik.io/v2.2/middlewares/headers/#customrequestheaders
- https://docs.traefik.io/v1.7/basics/#custom-headers
### For more information
If you have any questions or comments about this advisory, open an issue in [Traefik](https://github.com/containous/traefik/issues).
## Credit
This issue was found by the GitHub Application Security Team and reported on behalf of the GHAS by the GitHub Security Lab Team. | fixed | osv:GHSA-6qq8-5wq3-86rp |