Executive Summary

[{'type': 'paragraph', 'content': "This vulnerability exists in Caddy's FastCGI path splitting logic used to determine SCRIPT_NAME, SCRIPT_FILENAME, and PATH_INFO for PHP requests. The problem arises because Caddy computes the split index on a lowercased copy of the request path but then uses that index to slice the original path string. This is unsafe for Unicode characters since lowercasing can change the UTF-8 byte length of some characters, causing the byte offsets to mismatch."}, {'type': 'paragraph', 'content': "As a result, Caddy can derive incorrect path components, potentially causing a request containing '.php' to execute a different on-disk file than intended. This path confusion can lead to unintended PHP execution of non-.php files, especially in setups where an attacker can control file contents, such as upload features."}, {'type': 'paragraph', 'content': 'The vulnerability is remotely triggerable via crafted URLs and affects all Caddy versions prior to 2.11.0. It was fixed in version 2.11.0.'}] [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to path confusion where PHP requests execute unintended files on disk. In environments where an attacker can upload or control file contents, this can result in the execution of non-.php files as PHP scripts.

Such unintended execution can potentially lead to remote code execution (RCE), allowing attackers to run arbitrary code on the server depending on the deployment specifics.

Because the vulnerability is remotely triggerable via crafted URLs, it poses a significant security risk to affected Caddy servers.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by identifying if your system is running a vulnerable version of Caddy prior to 2.11.0, as the issue lies in the FastCGI path splitting logic. Detection involves checking the Caddy server version and monitoring for unusual PHP execution behavior triggered by crafted URLs containing Unicode characters that expand when lowercased.

There are no specific commands provided in the resources to detect exploitation attempts directly on the network or system. However, you can check the Caddy version by running:

• caddy version

Additionally, monitoring web server logs for requests containing unusual Unicode characters or unexpected PHP file executions may help identify exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Caddy to version 2.11.0 or later, where the vulnerability has been fixed by correcting the path splitting logic to handle Unicode characters safely.

Until the upgrade can be applied, restrict or disable any features that allow attackers to upload or control file contents, as this is a key factor in exploitation.

Also, consider monitoring and filtering incoming requests for suspicious Unicode payloads that could trigger the vulnerability.

Useful 0 Not Useful 0