Benasin

**Name of the Vulnerable Software and Affected Versions** imgproxy versions prior to 3.27.2 **Description** The issue concerns imgproxy, a server for resizing, processing, and converting images. It does not block the `0.0.0.0` address, even when `IMGPROXY ALLOW LOOPBACK SOURCE ADDRESSES` is set to false. This can expose services on the local host. The problem arises because the check against loopback addresses is insufficient, as it strictly follows the definition of loopback IPs starting with `127`, and thus does not block `0.0.0.0`. **Recommendations** For imgproxy versions prior to 3.27.2, update to version 3.27.2 or later to resolve the issue. As a temporary workaround, consider restricting access to services on the local host to minimize the risk of exploitation. Avoid using the `0.0.0.0` address in configurations where `IMGPROXY ALLOW LOOPBACK SOURCE ADDRESSES` is set to false until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Traefik versions prior to 2.10.6 Traefik versions prior to 3.0.0-beta5 **Description** The issue arises when a request is sent to Traefik with a URL fragment. Traefik automatically URL encodes and forwards the fragment to the backend server, violating RFC 7230. This can be used to bypass frontend proxy URI-based access control restrictions when combined with another frontend proxy like Nginx. For example, an attacker can request `/#/../admin` to bypass Nginx configuration restrictions. If the backend server follows the RFC and ignores any characters after the fragment, it won't be vulnerable. However, if Nginx is chained with another reverse proxy like Traefik, which automatically URL encodes the character `#`, the URL will become `/%23/../admin`, allowing the attacker to completely bypass access restrictions. **Recommendations** For Traefik versions prior to 2.10.6, upgrade to version 2.10.6 or later. For Traefik versions prior to 3.0.0-beta5, upgrade to version 3.0.0-beta5 or later. As a temporary workaround, consider restricting access to the vulnerable `/#/` endpoint until a patch is available. Avoid using URL fragments in requests to Traefik until the issue is resolved.