Summary
Traefik's Kubernetes Ingress NGINX provider can mishandle rewritten paths when a regex capture permits attacker-controlled text to form a dot-segment traversal path. Under the affected routing configuration, an unauthenticated request may reach a backend endpoint protected by a separate authentication middleware, resulting in a route-level authentication bypass.
Traefik's Kubernetes Ingress NGINX provider can mishandle rewritten paths when a regex capture permits attacker-controlled text to form a dot-segment traversal path. Under the affected routing configuration, an unauthenticated request may reach a backend endpoint protected by a separate authentication middleware, resulting in a route-level authentication bypass.
Affected context
The vulnerability may occur in Traefik deployments using the Kubernetes Ingress NGINX provider and the RewriteTarget middleware generated from rewrite-target annotations. Risk depends on an Ingress regex that captures request text without requiring a path separator, a backend that normalizes dot segments, and a protected endpoint reachable through a separate router using BasicAuth, DigestAuth, or ForwardAuth.
The vulnerability may occur in Traefik deployments using the Kubernetes Ingress NGINX provider and the RewriteTarget middleware generated from rewrite-target annotations. Risk depends on an Ingress regex that captures request text without requiring a path separator, a backend that normalizes dot segments, and a protected endpoint reachable through a separate router using BasicAuth, DigestAuth, or ForwardAuth.
Exploit preconditions
- Attack surface: HTTP request handling through a Traefik Kubernetes Ingress route
- Required access: Ability to send requests to the publicly reachable route; configuration modification is generally not required
- Trigger point: Path rewriting performed after the request matches an affected regex-based Ingress route
- Why exploitation is possible: The rewritten path may contain dot segments, and validation does not sufficiently normalize and reject the result before forwarding it to a backend
- Deployment dependency: A backend or protected route must normalize the traversal path to an endpoint that is otherwise subject to authentication controls
- Attack surface: HTTP request handling through a Traefik Kubernetes Ingress route
- Required access: Ability to send requests to the publicly reachable route; configuration modification is generally not required
- Trigger point: Path rewriting performed after the request matches an affected regex-based Ingress route
- Why exploitation is possible: The rewritten path may contain dot segments, and validation does not sufficiently normalize and reject the result before forwarding it to a backend
- Deployment dependency: A backend or protected route must normalize the traversal path to an endpoint that is otherwise subject to authentication controls
Why this happens
The underlying issue is insufficient path validation after applying a user-influenced rewrite replacement. A regex capture can contribute text that changes the rewritten path structure, while dot-segment normalization is deferred to a downstream component or is not applied before routing and forwarding.
This maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, applied here to URL path routing rather than filesystem access. The insecure pattern is trusting a rewritten path without canonicalizing it and enforcing authorization decisions against the canonical destination.
The underlying issue is insufficient path validation after applying a user-influenced rewrite replacement. A regex capture can contribute text that changes the rewritten path structure, while dot-segment normalization is deferred to a downstream component or is not applied before routing and forwarding.
This maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, applied here to URL path routing rather than filesystem access. The insecure pattern is trusting a rewritten path without canonicalizing it and enforcing authorization decisions against the canonical destination.
Potential impact
- An unauthenticated requester may reach endpoints protected by route-level authentication
- Sensitive administrative or operational responses could be exposed
- Backend actions intended only for authenticated users could be invoked
- Security boundaries between public and protected routers could be bypassed
- Downstream services may process unexpected normalized paths
- An unauthenticated requester may reach endpoints protected by route-level authentication
- Sensitive administrative or operational responses could be exposed
- Backend actions intended only for authenticated users could be invoked
- Security boundaries between public and protected routers could be bypassed
- Downstream services may process unexpected normalized paths
General mitigation guidance
Mitigation generally focuses on treating rewritten paths as untrusted routing data and enforcing authorization after canonicalization.
Common defensive patterns include:
- Require explicit path separators and narrowly constrain regex capture groups
- Canonicalize rewritten paths before route selection and backend forwarding
- Reject dot segments and ambiguous path representations after replacement
- Apply authentication and authorization to the canonical destination rather than only the original router
- Prefer explicit, allowlisted route mappings over broad capture-and-rewrite rules
- Reduce backend privileges and isolate protected administrative endpoints
- Use defense-in-depth controls in backends that normalize and validate incoming paths
Mitigation generally focuses on treating rewritten paths as untrusted routing data and enforcing authorization after canonicalization.
Common defensive patterns include:
- Require explicit path separators and narrowly constrain regex capture groups
- Canonicalize rewritten paths before route selection and backend forwarding
- Reject dot segments and ambiguous path representations after replacement
- Apply authentication and authorization to the canonical destination rather than only the original router
- Prefer explicit, allowlisted route mappings over broad capture-and-rewrite rules
- Reduce backend privileges and isolate protected administrative endpoints
- Use defense-in-depth controls in backends that normalize and validate incoming paths
How teams detect issues like this
Organizations can look for this weakness through:
- Static analysis of rewrite-target handling and path canonicalization logic
- Configuration reviews for broad regex captures and replacement variables
- Code review signals showing authorization decisions made before path normalization
- Tests that compare authorization behavior for equivalent normalized and non-normalized paths
- Integration tests covering dot segments, encoded separators, repeated separators, and alternate path forms
- Policy enforcement requiring explicit route allowlists and rejecting ambiguous rewrite configurations
- Runtime monitoring for requests whose original and normalized paths differ or target protected route namespaces
Organizations can look for this weakness through:
- Static analysis of rewrite-target handling and path canonicalization logic
- Configuration reviews for broad regex captures and replacement variables
- Code review signals showing authorization decisions made before path normalization
- Tests that compare authorization behavior for equivalent normalized and non-normalized paths
- Integration tests covering dot segments, encoded separators, repeated separators, and alternate path forms
- Policy enforcement requiring explicit route allowlists and rejecting ambiguous rewrite configurations
- Runtime monitoring for requests whose original and normalized paths differ or target protected route namespaces
