CVE-2024-21493

All versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Validation of Array Index when parsing a Caddyfile. Multiple parsing functions in the affected library do not validate whether their input values are nil before attempting to access elements, which can lead to a panic (index out of range). Panics during the parsing of a configuration file may introduce ambiguity and vulnerabilities, hindering the correct interpretation and configuration of the web server.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/
https://github.com/greenpau/caddy-security/issues/263
https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-5961078

Configurations

No configuration.

History

20 Feb 2024, 19:50

Type	Values Removed	Values Added
Summary		(es) Todas las versiones del paquete github.com/greenpau/caddy-security son vulnerables a una validación incorrecta del índice de matriz al analizar un Caddyfile. Varias funciones de análisis en la librería afectada no validan si sus valores de entrada son nulos antes de intentar acceder a los elementos, lo que puede provocar pánico (índice fuera de rango). Los pánicos durante el análisis de un archivo de configuración pueden introducir ambigüedad y vulnerabilidades, dificultando la correcta interpretación y configuración del servidor web.

17 Feb 2024, 05:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-02-17 05:15

Updated : 2024-02-20 19:50

NVD link : CVE-2024-21493

Mitre link : CVE-2024-21493

CVE.ORG link : CVE-2024-21493

JSON object : View

Products Affected

No product.

CWE

CWE-129

Improper Validation of Array Index

5.3 /10