Lucene search

GitHub Advisory DatabaseGHSA-93X8-66J2-WWR5

HistoryFeb 17, 2024 - 6:30 a.m.

Server-Side Request Forgery in github.com/greenpau/caddy-security

2024-02-1706:30:35

CWE-918

GitHub Advisory Database

github.com

server-side request forgery

ssrf

x-forwarded-host header manipulation

vulnerability

github

caddy

software security

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

26.4%

JSON

All versions of the package github.com/greenpau/caddy-security are vulnerable to Server-side Request Forgery (SSRF) via X-Forwarded-Host header manipulation. An attacker can expose sensitive information, interact with internal services, or exploit other vulnerabilities within the network by exploiting this vulnerability.

Affected configurations

Vulners

Node

greenpaucaddy-securityRange≤1.1.23

VendorProductVersionCPE
greenpaucaddy-security*cpe:2.3:a:greenpau:caddy-security:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
greenpau	caddy-security	*	cpe:2.3:a:greenpau:caddy-security::::::::

References

blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy

github.com/advisories/GHSA-93x8-66j2-wwr5

github.com/greenpau/caddy-security/issues/269

nvd.nist.gov/vuln/detail/CVE-2024-21498

security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6249862

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

26.4%

JSON

Related for GHSA-93X8-66J2-WWR5