Caddy caddy-security Plugin Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in the caddy-security plugin for the Caddy web server, specifically in version 1.1.20. This vulnerability allows an attacker to inject an XSS payload into a URL, which is then executed in the context of the user's browser. The issue arises in URLs that include the payload and start with either '/admin' or '/settings/mfa/delete/'.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can execute arbitrary JavaScript in the context of the victim's browser. This could lead to session hijacking or other client-side attacks.

Reproduction

To reproduce this vulnerability, send a GET request to a Caddy server with the caddy-security plugin version 1.1.20. Include an XSS payload in the URL, ensuring it starts with '/admin' or '/settings/mfa/delete/'. The injected script will be executed, demonstrating the cross-site scripting vulnerability.

Remediation

To address this vulnerability, all string values should be treated as untrusted and properly escaped before being included in the HTML response. The 'safehtml/template' package can be used to generate output-safe HTML. Additionally, the caddy-security documentation should be expanded to promote the use of security headers, particularly the Content Security Policy (CSP) header, which can help mitigate the impact of XSS attacks.