Traefik < 3.6.10 HTTPRoute Rule Injection

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(318669);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/09");

  script_cve_id("CVE-2026-29777");
  script_xref(name:"IAVB", value:"2026-B-0059");

  script_name(english:"Traefik < 3.6.10 HTTPRoute Rule Injection");

  script_set_attribute(attribute:"synopsis", value:
"The remote macOS host is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Traefik installed on the remote macOS host is prior to 3.6.10. It is, therefore, affected
by a vulnerability:

  - Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.10, A tenant with write access to an
    HTTPRoute resource can inject backtick-delimited rule tokens into Traefik's router rule language via
    unsanitized header or query parameter match values. In shared gateway deployments, this can bypass
    listener hostname constraints and redirect traffic for victim hostnames to attacker-controlled
    backends. This vulnerability is fixed in 3.6.10. (CVE-2026-29777)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported
version number.");
  # https://github.com/traefik/traefik/security/advisories/GHSA-8q2w-wr49-whqj
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?7e713128");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Traefik version 3.6.10 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-29777");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/03/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/03/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/04");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:traefik:traefik");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"MacOS X Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("macos_traefik_installed.nbin");
  script_require_keys("Host/local_checks_enabled", "installed_sw/traefik");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {
      'scope': 'target',
      'match': {'os': 'macos'}
    }
  ],
  'checks': [
    {
      'product': {'name': 'traefik', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'fixed_version': '3.6.10'}
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);