Double Decoding of the Same Data in Caddy - #VU163188

Vulnerability details

The vulnerability allows an unauthenticated remote attacker to read static files protected by path-based deny rules on affected Caddy sites.

The vulnerability exists due to double decoding of unescaped {http.matchers.file.remainder} values in Caddy's rewrite handler when sites rewrite using this placeholder after path-based deny checks. An unauthenticated remote attacker can submit double-encoded traversal sequences in path information to bypass those checks and retrieve protected files through the file server.

Affected software

Remediation

External References

• https://github.com/caddyserver/caddy/security/advisories/GHSA-69hv-5jfc-mvmv

Related Security Bulletins

• Multiple vulnerabilities in Caddy