PT-2023-12957 · Caddy+1 · Caddy+1

Hunt2Behunter + 2 · Publicado 2022-05-12 · Atualizado 2023-02-16 · CVE-2022-28923

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Caddy version 2.4.6

Description The issue allows attackers to redirect users to phishing websites via crafted URLs due to improper request sanitization. A crafted URL can cause the static file handler to redirect to an attacker-chosen URL, enabling open redirect attacks.

Recommendations For Caddy version 2.4.6, update to a version that fixes the open redirection vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

ALT-PU-2022-1850

CVE-2022-28923

GHSA-QPM3-VR34-H8W8

GO-2023-1567

Produtos afetados

Alt Linux

Caddy

Referências · 13

• 🔥 https://lednerb.de/en/publications/responsible-disclosure/caddy-open-redirect-vulnerability · Exploit
• https://github.com/caddyserver/caddy · Nota
• https://github.com/caddyserver/caddy/commit/78b5356f2b1945a90de1ef7f2c7669d82098edbd · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-28923 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-28923 · Nota de Segurança
• https://osv.dev/vulnerability/GO-2023-1567 · Aviso do Fabricante
• https://t.me/cibsecurity/57638 · Publicação no Telegram
• https://t.me/cvenotify/43748 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2022-28923 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2022-28923 · Aviso do Fabricante
• https://github.com/advisories/GHSA-qpm3-vr34-h8w8 · Nota
• https://pkg.go.dev/vuln/GO-2023-1567 · Nota
• https://osv.dev/vulnerability/GHSA-qpm3-vr34-h8w8 · Aviso do Fabricante