Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1oMnBoLXZobTctZzRocM4AAwNV

Traefik may display authorization header in the debug logs

Impact

There is a potential vulnerability in Traefik displaying the Authorization header in its debug logs.

Traefik uses oxy to provide the following features:

• Round Robin: https://doc.traefik.io/traefik/routing/services/#weighted-round-robin-service
• Buffering: https://doc.traefik.io/traefik/middlewares/http/buffering/
• Circuit Breaker: https://doc.traefik.io/traefik/middlewares/http/circuitbreaker/
• In-Flight Requests: https://doc.traefik.io/traefik/middlewares/http/inflightreq/

In such cases, if the log level is set to DEBUG, the credentials provided using the Authorization header are displayed in the debug logs:

level=debug msg="vulcand/oxy/roundrobin/rr: completed ServeHttp on request" Request="{\\"Method\\":\\"POST\\",\\"URL\\":{\\"Scheme\\":\\"\\",\\"Opaque\\":\\"\\",\\"User\\":null,\\"Host\\":\\"\\",\\"Path\\":\\"/<redacted>/<redacted>\\",\\"RawPath\\":\\"\\",\\"ForceQuery\\":false,\\"RawQuery\\":\\"\\",\\"Fragment\\":\\"\\",\\"RawFragment\\":\\"\\"},\\"Proto\\":\\"HTTP/2.0\\",\\"ProtoMajor\\":2,\\"ProtoMinor\\":0,\\"Header\\":{\\"Authorization\\":[\\"Bearer <token value was here>\\"],\\"Content-Type\\":[\\"application/grpc\\"],\\"Grpc-Accept-Encoding\\":[\\"gzip\\"],\\"Grpc-Timeout\\":[\\"29999886u\\"],\\"Te\\":[\\"trailers\\"],\\"User-Agent\\":[\\"<redacted>\\"],<remainder of log message removed>

Patches

https://github.com/traefik/traefik/pull/9574
https://github.com/traefik/traefik/releases/tag/v2.9.6

Workarounds

Set the log level to INFO, WARN, or ERROR.

For more information

If you have any questions or comments about this advisory, please open an issue.

Permalink: https://github.com/advisories/GHSA-h2ph-vhm7-g4hp
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oMnBoLXZobTctZzRocM4AAwNV
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Low
Classification: General
Published: over 1 year ago
Updated: over 1 year ago

CVSS Score: 3.5
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N

Identifiers: GHSA-h2ph-vhm7-g4hp, CVE-2022-23469
References:

• https://github.com/traefik/traefik/security/advisories/GHSA-h2ph-vhm7-g4hp
• https://github.com/traefik/traefik/pull/9574
• https://github.com/traefik/traefik/releases/tag/v2.9.6
• https://nvd.nist.gov/vuln/detail/CVE-2022-23469
• https://github.com/advisories/GHSA-h2ph-vhm7-g4hp

Repository: https://github.com/traefik/traefik
Blast Radius: 6.0

Affected Packages