PT-2023-12957 · Caddy+1 · Caddy+1

Hunt2Behunter + 2 · Published 2022-05-12 · Updated 2023-02-16 · CVE-2022-28923

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Caddy version 2.4.6

Description The issue allows attackers to redirect users to phishing websites via crafted URLs due to improper request sanitization. A crafted URL can cause the static file handler to redirect to an attacker-chosen URL, enabling open redirect attacks.

Recommendations For Caddy version 2.4.6, update to a version that fixes the open redirection vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

ALT-PU-2022-1850

CVE-2022-28923

GHSA-QPM3-VR34-H8W8

GO-2023-1567

Affected Products

Alt Linux

Caddy

References · 13

• 🔥 https://lednerb.de/en/publications/responsible-disclosure/caddy-open-redirect-vulnerability · Exploit
• https://osv.dev/vulnerability/GO-2023-1567 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28923 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-28923 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qpm3-vr34-h8w8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-28923 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-28923 · Vendor Advisory
• https://github.com/caddyserver/caddy · Note
• https://github.com/caddyserver/caddy/commit/78b5356f2b1945a90de1ef7f2c7669d82098edbd · Note
• https://t.me/cvenotify/43748 · Telegram Post
• https://t.me/cibsecurity/57638 · Telegram Post
• https://github.com/advisories/GHSA-qpm3-vr34-h8w8 · Note
• https://pkg.go.dev/vuln/GO-2023-1567 · Note