CVE-2023-47633
📋 TL;DR
Traefik's Docker integration creates an automatic route where Traefik serves as its own backend, causing 100% CPU consumption in a denial-of-service condition. This affects all Traefik deployments using Docker integration with default configuration. The vulnerability is automatically triggered by the configuration, not requiring external exploitation.
💻 Affected Systems
- Traefik
📦 What is this software?
Traefik by Traefik
Traefik by Traefik
Traefik by Traefik
Traefik by Traefik
Traefik by Traefik
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage due to 100% CPU consumption, making Traefik unresponsive to legitimate traffic and potentially affecting other services on the same host.
Likely Case
Service degradation or outage as the automatic route triggers CPU exhaustion, disrupting reverse proxy and load balancing functions.
If Mitigated
No impact if patched or if Docker integration is disabled or properly configured to avoid self-referencing routes.
🎯 Exploit Status
No exploitation required - the vulnerability triggers automatically when Traefik with Docker integration runs with default settings. This is a self-inflicted denial-of-service condition.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.10.6 or 3.0.0-beta5
Vendor Advisory: https://github.com/traefik/traefik/security/advisories/GHSA-6fwg-jrfw-ff7p
Restart Required: Yes
Instructions:
1. Stop the vulnerable Traefik instance. 2. Update to Traefik 2.10.6 or 3.0.0-beta5 using your package manager or container image. 3. Restart Traefik with the updated version.
🔧 Temporary Workarounds
Disable Docker integration
allRemove or disable Docker provider configuration to prevent automatic route creation
Remove Docker provider from Traefik configuration or set `providers.docker = false`
Configure explicit backends
allManually configure routes and backends instead of relying on automatic Docker discovery
Define explicit routers and services in Traefik configuration files
🧯 If You Can't Patch
- Disable Docker integration in Traefik configuration immediately
- Monitor CPU usage and restart Traefik if 100% CPU consumption is detected
🔍 How to Verify
Check if Vulnerable:
Check if Traefik version is below 2.10.6 or 3.0.0-beta5 AND Docker integration is enabled in configurationCheck Version:
traefik versionVerify Fix Applied:
Confirm Traefik version is 2.10.6 or higher (or 3.0.0-beta5+) and monitor CPU usage remains normal📡 Detection & Monitoring
Log Indicators:
- High CPU usage alerts
- Traefik process consuming 100% CPU
- Service timeout or degradation logs
Network Indicators:
- Increased response times
- Service unavailability
- Timeout errors from Traefik
SIEM Query:
process_name:"traefik" AND cpu_usage:>95🔗 References
- https://github.com/traefik/traefik/releases/tag/v2.10.6
- https://github.com/traefik/traefik/releases/tag/v3.0.0-beta5
- https://github.com/traefik/traefik/security/advisories/GHSA-6fwg-jrfw-ff7p
- https://github.com/traefik/traefik/releases/tag/v2.10.6
- https://github.com/traefik/traefik/releases/tag/v3.0.0-beta5
- https://github.com/traefik/traefik/security/advisories/GHSA-6fwg-jrfw-ff7p
