Incorrect authorization in Traefik - #VU137267

Detailed vulnerability description

The vulnerability allows a remote user to inject attacker-selected authenticated identity headers into downstream applications.

The vulnerability exists due to incorrect authorization in HTTPRoute backendRef ExtensionRef resolution in Traefik's Kubernetes Gateway API provider when resolving HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef for a cross-namespace backend Service. A remote user can create a crafted HTTPRoute that binds a Middleware from the backend namespace without a separate grant to inject attacker-selected authenticated identity headers into downstream applications.

Exploitation requires HTTPRoute authoring capability and a ReferenceGrant that permits a cross-namespace Service reference.

Remediation

Sources

• https://github.com/traefik/traefik/security/advisories/GHSA-qq9q-x9w4-chhj
• https://github.com/traefik/traefik/releases/tag/v3.7.7