PT-2024-18914 · Unknown · Caddy-Security

David Pokora + 2 · Published 2024-02-16 · Updated 2024-06-28 · CVE-2024-21499

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions github.com/greenpau/caddy-security versions all

Description The issue is related to HTTP Header Injection via the X-Forwarded-Proto header, which can be exploited due to the software redirecting to the injected protocol. This could lead to the bypass of security mechanisms or confusion in handling TLS.

Recommendations For all versions, consider disabling the redirect functionality based on the X-Forwarded-Proto header until a patch is available. Restrict access to the vulnerable module to minimize the risk of exploitation. Avoid using the X-Forwarded-Proto header in redirects to prevent potential HTTP Header Injection attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

CWE-644

Related Identifiers

CVE-2024-21499

GHSA-R969-783F-6JQR

GO-2024-2562

Affected Products

Caddy-Security

References · 10

• https://osv.dev/vulnerability/GHSA-r969-783f-6jqr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21499 · Security Note
• https://osv.dev/vulnerability/CVE-2024-21499 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2562 · Vendor Advisory
• https://github.com/greenpau/caddy-security/issues/270 · Note
• https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy · Note
• https://twitter.com/CVEnew/status/1758721375232307277 · Twitter Post
• https://github.com/advisories/GHSA-r969-783f-6jqr · Note
• https://twitter.com/VulmonFeeds/status/1758744432583549430 · Twitter Post
• https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6249863 · Note