REDHAT-BUG-2491907: High severity Caddy Caddy vulnerability
Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forwardauth copyheaders deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through phpfastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with . This lets a client send an underscore alias that survives the forwardauth delete step but becomes the same PHP/FastCGI variable. Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy. This vulnerability is fixed in 2.11.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Caddyto a version that resolves this vulnerability.Fixed in 2.11.4
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2491907?
The severity of REDHAT-BUG-2491907 is categorized as high with a score of 7.
How do I fix REDHAT-BUG-2491907?
To fix REDHAT-BUG-2491907, upgrade Caddy to version 2.11.4 or later.
What is the impact of REDHAT-BUG-2491907 on security?
REDHAT-BUG-2491907 can lead to potential exposure of client identity information due to improper handling of headers.
What version of Caddy is vulnerable to REDHAT-BUG-2491907?
Caddy versions prior to 2.11.4 are vulnerable to REDHAT-BUG-2491907.
What is the description of REDHAT-BUG-2491907?
REDHAT-BUG-2491907 describes a vulnerability in Caddy where the forward_auth copy_headers functionality improperly manages client-supplied identity headers.