github.com/traefik/traefik/v3: FastProxy backend connection pool leaks connection-bound NTLM/Negotiate identity to unauthenticated clients

Summary

There is a high severity vulnerability in Traefik's experimental FastProxy implementation. Traefik isolates connection-bound NTLM and Negotiate (Kerberos) backend authentication by pinning the backend connection on which a client authenticated to that client's frontend connection, so that no other client is ever served on it. When experimental.fastProxy is enabled, requests to plain http:// backends are dispatched through FastProxy's own connection pool, which was keyed only by ServersTransport and target URL and did not apply that isolation. Against a backend that binds an identity to a persistent connection, an unauthenticated client on a brand-new frontend connection could be handed a backend connection on which a victim had already completed an NTLM or Negotiate handshake, and be served as that victim, reading victim-only data and performing actions in the victim's name without presenting any credentials. Affected deployments require experimental.fastProxy enabled, a plain HTTP backend using connection-bound NTLM or Negotiate authentication, and backend keep-alive; the default proxy implementation is not affected. FastProxy now dispatches requests carrying an NTLM or Negotiate credential through a connection pool dedicated to their frontend connection, and every subsequent request on that frontend connection to the same backend reuses it.

FastProxy was introduced in Traefik v3.2: v3.2 through v3.6 are affected but are no longer maintained and will not receive a patch of their own, users on those lines must upgrade to v3.7.14. Traefik v2 and earlier v3 versions are not affected.

Patches

• https://github.com/traefik/traefik/releases/tag/v3.7.14

For more information

If you have any questions or comments about this advisory, please open an issue.