23 matches found
Caddy 数据伪造问题漏洞
Caddy is an open-source, cross-platform HTTP/Web server developed by the Caddy company. Versions of Caddy 2.10.0 to 2.11.2 had a data manipulation vulnerability. This vulnerability stemmed from the forwardauth copyheaders function not stripping the headers provided by the client, which could lead...
GHSA-7R4P-VJF4-GXV4 Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation
Summary Caddy's forwardauth directive with copyheaders generates conditional header-set operations that only fire when the upstream auth service includes the named header in its response. No delete or remove operation is generated for the original client-supplied request header with the same name...
