Caddy Out-of-Bounds Read Vulnerability in HTTP Rewrite Module Allowing Denial-of-Service

A vulnerability in Caddy version 2.5.1's HTTP rewrite module allows for an out-of-bounds read, which can lead to a denial-of-service condition. This issue arises from a flawed URI parsing implementation in the rewrite function, where certain URI fragments can cause a runtime panic by creating invalid slice bounds. Although this vulnerability was reported as a security issue, it has been disputed, with claims that it merely reflects a bug in handling malformed URIs, particularly under 'bad' configuration scenarios. The reported issue does not affect server availability, as Caddy continues to process requests normally after logging the error.

Impact

Exploitation of this vulnerability causes a runtime panic due to a slice bounds error, which disrupts the current request handling but does not crash the server. Caddy recovers from the panic and resumes normal operations, although the error is only logged if the server is in debug mode.

Reproduction

To reproduce this vulnerability, configure Caddy v2.5.1 with a rewrite rule that includes a fragment and query string, such as '/bad' rewritten to '/#?'. When a request is made to a path that triggers the rewrite, Caddy will panic due to the improper URI handling, creating a slice bounds error. This can be automated with a test that sends a request matching the rewrite rule, causing the server to panic and log the error, while still serving other requests normally.

Remediation

Users can upgrade to Caddy version 2.5.2 or later, where this vulnerability has been fixed.