CVE-2024-21496

All versions of the package github.com/greenpau/caddy-security are vulnerable to Cross-site Scripting (XSS) via the Referer header, due to improper input sanitization. Although the Referer header is sanitized by escaping some characters that can allow XSS (e.g., [&], [<], [>], ["], [']), it does not account for the attack based on the JavaScript URL scheme (e.g., javascript:alert(document.domain)// payload). Exploiting this vulnerability may not be trivial, but it could lead to the execution of malicious scripts in the context of the target user’s browser, compromising user sessions.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/	Exploit Third Party Advisory
https://github.com/greenpau/caddy-security/issues/267	Exploit Issue Tracking
https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6249860	Third Party Advisory
https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/	Exploit Third Party Advisory
https://github.com/greenpau/caddy-security/issues/267	Exploit Issue Tracking
https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6249860	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:authcrunch:caddy-security:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-02-17 05:15

Updated : 2025-12-23 20:09

NVD link : CVE-2024-21496

Mitre link : CVE-2024-21496

CVE.ORG link : CVE-2024-21496

JSON object : View

Products Affected

authcrunch

caddy-security

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-21496", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "report@snyk.io", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2024-02-17T05:15:09.603", "references": [{"url": "https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/", "tags": ["Exploit", "Third Party Advisory"], "source": "report@snyk.io"}, {"url": "https://github.com/greenpau/caddy-security/issues/267", "tags": ["Exploit", "Issue Tracking"], "source": "report@snyk.io"}, {"url": "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6249860", "tags": ["Third Party Advisory"], "source": "report@snyk.io"}, {"url": "https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/greenpau/caddy-security/issues/267", "tags": ["Exploit", "Issue Tracking"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6249860", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "report@snyk.io", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "All versions of the package github.com/greenpau/caddy-security are vulnerable to Cross-site Scripting (XSS) via the Referer header, due to improper input sanitization. Although the Referer header is sanitized by escaping some characters that can allow XSS (e.g., [&], [<], [>], [\"], [']), it does not account for the attack based on the JavaScript URL scheme (e.g., javascript:alert(document.domain)// payload). Exploiting this vulnerability may not be trivial, but it could lead to the execution of malicious scripts in the context of the target user\u2019s browser, compromising user sessions."}, {"lang": "es", "value": "Todas las versiones del paquete github.com/greenpau/caddy-security son vulnerables a Cross-site Scripting (XSS) a trav\u00e9s del encabezado Referer, debido a una desinfecci\u00f3n de entrada inadecuada. Aunque el encabezado Referer se desinfecta mediante el escape de algunos caracteres que pueden permitir XSS (por ejemplo, [&], [<], [>], [\"], [']), no tiene en cuenta el ataque basado en el esquema de URL de JavaScript (por ejemplo, javascript:alert(document.domain)// payload). Explotar esta vulnerabilidad puede no ser trivial, pero podr\u00eda llevar a la ejecuci\u00f3n de scripts maliciosos en el contexto del navegador del usuario objetivo, comprometiendo las sesiones del usuario."}], "lastModified": "2025-12-23T20:09:22.520", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:authcrunch:caddy-security:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FEFE7B79-CA27-471B-9450-CFC92FF1A9B4"}], "operator": "OR"}]}], "sourceIdentifier": "report@snyk.io"}