Lucene search

GoogleOSV:GHSA-8G85-WHQH-CR2F

HistoryDec 05, 2023 - 6:12 p.m.

Traefik vulnerable to potential DDoS via ACME HTTPChallenge

2023-12-0518:12:37

Google

osv.dev

traefik

vulnerability

ddos

acme

httpchallenge

slowloris attack

patch

tlschallenge

dnschallenge

let's encrypt

tls certificates

security advisory

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

6.9

Confidence

High

EPSS

0.001

Percentile

42.0%

JSON

Impact

There is a potential vulnerability in Traefik managing the ACME HTTP challenge.

When Traefik is configured to use the HTTPChallenge to generate and renew the Let’s Encrypt TLS certificates, the delay authorized to solve the challenge (50 seconds) can be exploited by attackers (slowloris attack).

Patches

Workarounds

Replace the HTTPChallenge with the TLSChallenge or the DNSChallenge.

For more information

If you have any questions or comments about this advisory, please open an issue.

References

doc.traefik.io/traefik/https/acme/#dnschallenge

doc.traefik.io/traefik/https/acme/#httpchallenge

doc.traefik.io/traefik/https/acme/#tlschallenge

github.com/traefik/traefik

github.com/traefik/traefik/releases/tag/v2.10.6

github.com/traefik/traefik/releases/tag/v3.0.0-beta5

github.com/traefik/traefik/security/advisories/GHSA-8g85-whqh-cr2f

nvd.nist.gov/vuln/detail/CVE-2023-47124

www.cloudflare.com/learning/ddos/ddos-attack-tools/slowloris

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

6.9

Confidence

High

EPSS

0.001

Percentile

42.0%

JSON

Related for OSV:GHSA-8G85-WHQH-CR2F