Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _. This lets a client send an underscore alias that survives the forward_auth delete step but becomes the same PHP/FastCGI variable. Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy. This vulnerability is fixed in 2.11.4.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NCaddyserver Caddy
APPCaddyserver< 2.11.4
Related vulnerabilities
Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused ...
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can ...
Caddy is an extensible server platform that uses TLS by default. From 2.7.0 until 2.11.3, the FastCGI transpor...
Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path match...
Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2,...