PT-2024-14586 · Caddy · Caddy+1

Ahpaleus · Published 2024-02-12 · Updated 2024-10-16 · CVE-2023-52430

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions caddy-security plugin for Caddy version 1.1.20

Description The issue allows reflected Cross-site Scripting (XSS) via a GET request to a URL that contains an XSS payload and begins with either a "/admin" or "/settings/mfa/delete/" substring. This can be exploited by sending a malicious GET request to the vulnerable URL.

Recommendations For version 1.1.20, consider disabling access to the "/admin" and "/settings/mfa/delete/" API endpoints until a patch is available. Restrict the use of the caddy-security plugin to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-52430

GHSA-XWMV-CX7P-FQFC

GO-2024-2549

Affected Products

Caddy

Caddy-Security Plugin

References · 13

• https://github.com/greenpau/caddy-security/issues/264 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-52430 · Security Note
• https://osv.dev/vulnerability/CVE-2023-52430 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xwmv-cx7p-fqfc · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2549 · Vendor Advisory
• https://github.com/greenpau/caddy-security · Note
• https://github.com/advisories/GHSA-xwmv-cx7p-fqfc · Note
• https://t.me/cvenotify/98257 · Telegram Post
• https://twitter.com/Esparta6108713/status/1757188952199467216 · Twitter Post
• https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy · Note
• https://t.me/cvenotify/71154 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1757217548720820493 · Twitter Post
• https://twitter.com/CVEnew/status/1757169971489030303 · Twitter Post