Traefik Path Matcher Vulnerability Bypasses Middleware

A vulnerability exists in Traefik versions through 2.11.22, 3.3.5, and 3.4.0-rc1, allowing requests with '/../' in the path to bypass middleware and directly reach the backend. This issue arises when using PathPrefix, Path, or PathRegex matchers, enabling unintended access to services by exploiting path traversal.

Impact

Exploitation allows for bypassing of middleware chains, potentially leading to unauthorized access or actions on backend services.

Reproduction

To reproduce this vulnerability, create an IngressRoute that uses a PathPrefix matcher along with a middleware. Then, send a request that includes '/../' in the path. The request will reach the backend service without applying the specified middleware, unless the path is sanitized by the router.

Remediation

Update to Traefik versions 2.11.24, 3.3.6, or 3.4.0-rc2. If an immediate update is not possible, add a PathRegexp rule to the matcher to exclude routes with '/../' in the path.