Improper Handling of URL Encoding (Hex Encoding) Affecting github.com/traefik/traefik/pkg/server package, versions <2.10.6 >=3.0.0-beta1 <3.0.0-beta5
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.06% (27th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMTRAEFIKTRAEFIKPKGSERVER-6099124
- published 5 Dec 2023
- disclosed 4 Dec 2023
- credit Khang Tran
Introduced: 4 Dec 2023
CVE-2023-47106 Open this link in a new tabHow to fix?
Upgrade github.com/traefik/traefik/pkg/server to version 2.10.6, 3.0.0-beta5 or higher.
Overview
Affected versions of this package are vulnerable to Improper Handling of URL Encoding (Hex Encoding) when a request is sent with a URL fragment. An attacker can bypass frontend proxy URI-based access control restrictions by exploiting the automatic URL encoding and forwarding of the fragment to the backend server.
Note:
This is only exploitable if another frontend proxy like Nginx is used.
References
CVSS Scores
version 3.1