Insufficient Verification of Data Authenticity

Summary

Traefik is a golang, Cloud Native Application Proxy. When an HTTP request is processed by Traefik, certain HTTP headers such as "X-Forwarded-Host" or "X-Forwarded-Port" are added by Traefik before the request is routed to the application. For an HTTP client, it should not be possible to remove or modify these headers. Since the application trusts the value of these headers, security implications might arise if they can be modified. For HTTP/1.1, however, it was found that some of these custom headers can indeed be removed and in certain cases manipulated. The attack relies on the HTTP/1.1 behavior, where headers can be defined as "hop-by-hop" via the HTTP Connection header. This vulnerability affects github.com/traefik/traefik versions prior to 2.11.9, and 3.x prior to 3.1.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.