Traefik: Kubernetes Ingress and Service annotations allow cross-namespace references to Middlewares, ServersTransports, and TLSOptions

For more information

If you have any questions or comments about this advisory, please open an issue.

Traefik: Missing Cross-Namespace Validation When Using K8s Annotations

Brief Summary

Traefik in Kubernetes (K8s) allows cross-namespace access to Traefik resources when using Annotations on Ingress and Service resources.

Table of Content

• Traefik: Missing Cross-Namespace Validation When Using K8s Annotations
  • Brief Summary
  • Table of Content
  • Description
  • Affected Version
  • Source Code References
  • Prerequisites
  • Impact
  • Security Researcher / Reporter
  • Proof of Concept
    • Middleware Proof Of Concept
      • Step 1: Preparation
      • Step 2: Create Victim's Resources
      • Step 3: Create Attacker Resources
      • Step 4: Attacker steals API Token
    • ServersTransport Proof Of Concept
      • Step 1: Create Victim and Attacker Namespaces
      • Step 2: Create Victim Resources
      • Step 3: Create Attacker Resources
      • Step 3: Attacker steals Client Certificate to authenticate against protected resource living in the victim's own namespace
  • Recommendation
  • Appendix
    • Resources
      • PoC router.middlewares / victim.yaml
      • PoC router.middlewares / attacker.yaml
      • PoC service.serverstransport / victim.yaml
      • PoC service.serverstransport / attacker.yaml
      • PoC router.middlewares intern-demo-access-victims-pod-wo-auth.txt
      • PoC router.middlewares intern-demo-access-victims-pod-with-auth.txt
    • Test Setup

Description

When using the Ingress and Service Annotations, it is possible to reference Middlewares, ServersTransports, and TLSOptions from foreign namespaces. While this is disallowed by default for Traefik's Kubernetes CRDs (by the Configuration Option providers.kubernetesCRD.allowCrossNamespace), no validation is done when using Annotations on K8s Ingress and Service resources.

An attacker can include these resources in an Ingress or Service configuration and thereby partially bypassing namespace-based tenant isolation. In certain cases, this will give an attacker access to data of services in other namespaces, for instance:

• If a middleware adds an API access token through the Header middleware, an attacker can steal this token.
• An attacker could include a ServersTransport that does client certificate authentication against a service to access this service.
• An attacker could include a ForwardAuth middleware to gain access to the internal response headers of the forward auth service and thus might steal internal tokens.

Affected Version

The vulnerability was tested in the current Traefik version v3.6.5. Older versions are affected, too.

Source Code References

Ingress and Service Annotations are vulnerable. There is no check implemented in:

pkg/provider/kubernetes/ingress/kubernetes.go

Traefik's Kubernetes CRDs are not vulnerable and prevent cross namespace access:

pkg/provider/kubernetes/crd/kubernetes_http.go

Prerequisites

• Traefik is installed in Kubernetes
  • No special configuration is required as the kubernetesIngress provider is enabled by default
• The attacker needs permission to create or modify Ingress or Service resources in one namespace
• The name of the namespace and the name of the Middleware, TLSOption, or ServersTransport resource they want to target

Impact

An attacker can include Middlewares, ServersTransports, and TLSOptions resources from foreign namespaces in their own Ingress or Service configuration, thereby partially bypassing namespace-based tenant isolation. In certain cases, this will give an attacker access to data of services in other namespaces.

Security Researcher / Reporter

• Lorin Lehawany of ERNW Enno Rey Netzwerke GmbH
• Sven Nobis of ERNW Enno Rey Netzwerke GmbH

Proof of Concept

The following descriptions explain the exploitation in detail for the two affected resource types Middleware and ServersTransport.

The proof of concept (PoC) was tested in a Traefik setup installed via Helm chart in version 37.4.0, but with the most recent Traefik app version v3.6.5 and the default configuration. See the test setup section for details.

Middleware Proof Of Concept

The following steps demonstrate the problem with the affected router.middlewares annotation.

This PoC even works with restrictive Network Policies set.

Step 1: Preparation

First, the namespaces traefik-victim and traefik-attacker are created:

kubectl create namespace traefik-victim
kubectl create namespace traefik-attacker

namespace/traefik-victim created
namespace/traefik-attacker created

In the next steps, the resources in the victim.yaml are created in the namespace traefik-victim, and the resources in the attacker.yaml are created in the namespace traefik-attacker.

Step 2: Create Victim's Resources

This step creates some resources to simulate a typical vulnerable setup with an application that uses Traefik and Ingress.

The victim.yaml creates an Ingress resource with the name traefik-ingress in the namespace traefik-victim. The Ingress exposes the victim's application under the hostname `traefik