Maciej Domanski

Name of the Vulnerable Software and Affected Versions: caddy-security versions prior to 1.0.42 Description: The issue is related to the use of insufficiently random values in the caddy-security plugin, which can be exploited by a remote attacker to conduct OAuth replay attacks and generate insecure multifactor authentication secrets and API keys in the database. The insecure random number generation library used by the plugin could possibly be predicted via a brute-force search, allowing attackers to use the potentially predictable nonce value for authentication purposes in the OAuth flow. Recommendations: For versions prior to 1.0.42, update to version 1.0.42 or later to resolve the issue. As a temporary workaround, consider restricting access to the OAuth flow and multifactor authentication features until the update is applied. Additionally, avoid using the potentially predictable nonce value for authentication purposes and restrict the generation of API keys in the database package until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** github.com/greenpau/caddy-security (affected versions not specified) **Description** The issue is related to Insufficient Session Expiration due to improper user session invalidation upon clicking the "Sign Out" button. User sessions remain valid even after requests are sent to "/logout" and "/oauth2/google/logout" API endpoints. Attackers who gain access to an active but supposedly logged-out session can perform unauthorized actions on behalf of the user. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** github.com/greenpau/caddy-security versions all **Description** The issue arises from improper validation of array indices when parsing a Caddyfile. Multiple parsing functions in the affected library do not check if their input values are nil before attempting to access elements, leading to potential panics due to index out of range errors. These panics during configuration file parsing can introduce ambiguity and vulnerabilities, affecting the correct interpretation and configuration of the web server. **Recommendations** For github.com/greenpau/caddy-security version all, consider implementing input validation to check for nil values before accessing array elements to prevent index out of range panics. As a temporary workaround, carefully review and validate all Caddyfile configurations to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** github.com/greenpau/caddy-security versions all **Description** The issue concerns improper input sanitization, allowing for Authentication Bypass by Spoofing via the X-Forwarded-For header. An attacker can spoof an IP address used in the user identity module, specifically targeting the /whoami API endpoint. This could lead to unauthorized access if the system trusts the spoofed IP address. **Recommendations** As a temporary workaround, consider disabling the use of the X-Forwarded-For header in the user identity module until a patch is available. Restrict access to the /whoami API endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** github.com/greenpau/caddy-security versions all **Description** The issue is related to Cross-site Scripting (XSS) via the Referer header, caused by improper input sanitization. Although some characters are escaped to prevent XSS, the sanitization does not account for attacks based on the JavaScript URL scheme. This could lead to the execution of malicious scripts in the context of the target user's browser, compromising user sessions. **Recommendations** For github.com/greenpau/caddy-security versions all, consider implementing proper input sanitization for the Referer header to prevent XSS attacks. As a temporary workaround, consider restricting access to sensitive resources that rely on the Referer header until a proper fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** github.com/greenpau/caddy-security versions all **Description** The issue allows for Open Redirect via the `redirect url` parameter. An attacker could perform a phishing attack, tricking users into visiting a malicious website by crafting a convincing URL with this parameter. To exploit this, the user must take an action, such as clicking on a portal button or using the browser’s back button, to trigger the redirection. **Recommendations** For all versions, as a temporary workaround, consider restricting the use of the `redirect url` parameter until a patch is available. Avoid using the `redirect url` parameter in affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** github.com/greenpau/caddy-security versions all **Description** The issue is related to Server-side Request Forgery (SSRF) via X-Forwarded-Host header manipulation. An attacker can expose sensitive information, interact with internal services, or exploit other vulnerabilities within the network by exploiting this vulnerability. **Recommendations** For github.com/greenpau/caddy-security versions all, as a temporary workaround, consider restricting access to the X-Forwarded-Host header to minimize the risk of exploitation. Avoid using the `X-Forwarded-Host` header in sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** github.com/greenpau/caddy-security versions all **Description** The issue is related to HTTP Header Injection via the `X-Forwarded-Proto` header, which can be exploited due to the software redirecting to the injected protocol. This could lead to the bypass of security mechanisms or confusion in handling TLS. **Recommendations** For all versions, consider disabling the redirect functionality based on the `X-Forwarded-Proto` header until a patch is available. Restrict access to the vulnerable module to minimize the risk of exploitation. Avoid using the `X-Forwarded-Proto` header in redirects to prevent potential HTTP Header Injection attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** github.com/greenpau/caddy-security versions all **Description** The issue concerns Improper Restriction of Excessive Authentication Attempts via the two-factor authentication (2FA) mechanism. Although the application blocks users after several failed attempts to provide 2FA codes, attackers can bypass this blocking mechanism by automating the application’s full multistep 2FA process. **Recommendations** For all versions, consider temporarily disabling the two-factor authentication (2FA) mechanism until a patch is available. Restrict access to the 2FA process to minimize the risk of exploitation. Avoid using automated processes that could trigger the 2FA mechanism excessively until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** EMCA Energy Logserver version 6.1.2 **Description** The issue concerns the api/admin/logoupload Logo File upload feature, which allows attackers to upload files to any location on the server. This is achieved through path traversal in the `filename` parameter. **Recommendations** For EMCA Energy Logserver version 6.1.2, consider restricting access to the api/admin/logoupload endpoint to minimize the risk of exploitation. As a temporary workaround, avoid using the `filename` parameter in the affected API endpoint until the issue is resolved.