CVE-2023-52430: caddy-security plugin for Caddy vulnerable to reflected Cross-site Scripting

February 13, 2024 (updated October 16, 2024)

The caddy-security plugin 1.1.20 for Caddy allows reflected XSS via a GET request to a URL that contains an XSS payload and begins with either a /admin or /settings/mfa/delete/ substring.

References

blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy
github.com/advisories/GHSA-xwmv-cx7p-fqfc
github.com/greenpau/caddy-security
github.com/greenpau/caddy-security/issues/264
nvd.nist.gov/vuln/detail/CVE-2023-52430

Code Behaviors & Features

Detect and mitigate CVE-2023-52430 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →