Traefik Identity Spoofing Vulnerability via Non-Canonical HTTP Header Injection

A vulnerability exists in Traefik's Basic and Digest authentication middlewares, prior to versions 2.11.42, 3.6.11, and 3.7.0-ea.3. When the 'headerField' is set with a non-canonical HTTP header name, an authenticated attacker can inject the canonical version of that header to impersonate any identity to the backend. This occurs because Traefik writes the header using a non-canonical key, creating a duplicate header entry. As a result, the backend reads the injected canonical header first, allowing the attacker to override the original value and control the identity being presented.

Impact

Exploitation of this vulnerability allows for identity impersonation by injecting canonical header values that override non-canonical ones, leading to unauthorized access or actions on behalf of the impersonated user.

Remediation

Users can upgrade to Traefik versions 2.11.42, 3.6.11, or 3.7.0-ea.3 to address this vulnerability.