CVE-2022-28923

Executive Summary

CVE-2022-28923 is an open redirect vulnerability in Caddy web server version 2.4.6. An attacker can craft a malicious URL that, when visited by a user, redirects them to an attacker-controlled domain. This flaw is classified under CWE-601 (URL Redirection to Untrusted Site) and has a CVSS v3.1 base score of 6.1 (Medium). The vulnerability is publicly known, with a verified proof-of-concept (PoC) and a Nuclei template available for detection. Successful exploitation can lead to phishing attacks, credential theft, and reputational damage. The recommended remediation is to upgrade to Caddy version 2.4.7 or later.

Supply Chain & Package Security

Caddy is a Go-based web server distributed as a standalone binary and also available via package managers. The vulnerability affects the core server binary, not a specific package ecosystem. Users should verify their Caddy version and update from official sources (e.g., GitHub releases, official website) to avoid supply chain risks.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must click a crafted link.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure possible.
• Integrity (I): Low (L) – Limited data modification possible.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The vulnerability requires user interaction but can be chained with phishing campaigns to steal credentials or spread malware.

Deep Dive & Mechanics

The open redirect vulnerability in Caddy 2.4.6 stems from improper validation of user-supplied input in the Location header during HTTP redirects. Specifically, the server fails to sanitize URLs containing backslashes or encoded path traversal sequences, allowing an attacker to craft a request that redirects to an arbitrary external domain.

The PoC URL /%5C%5Cinteract.sh/%252e%252e%252f exploits this by:

• %5C%5C decodes to \\ (double backslash), which Caddy interprets as a network path.
• interact.sh is the attacker-controlled domain.
• %252e%252e%252f decodes to %2e%2e%2f (URL-encoded ../), further confusing the parser.

When Caddy processes this request, it generates a redirect response with a Location header pointing to \\interact.sh/.., which browsers interpret as a redirect to http://interact.sh/ (or similar). This bypasses typical domain whitelisting checks.

Vulnerable vs. Patched Code

Vulnerable Code (Caddy 2.4.6): The vulnerable logic likely resides in the HTTP handler that constructs redirect URLs. It does not properly sanitize or validate the path component, allowing backslashes and encoded sequences to pass through.

// Pseudocode of vulnerable behavior
func redirectHandler(w http.ResponseWriter, r *http.Request) {
    // No validation of r.URL.Path
    http.Redirect(w, r, r.URL.Path, http.StatusMovedPermanently)
}

Patched Code (Caddy 2.4.7+): The fix introduces validation to reject URLs containing backslashes or encoded path traversal sequences that could lead to open redirects.

// Pseudocode of patched behavior
func redirectHandler(w http.ResponseWriter, r *http.Request) {
    if strings.Contains(r.URL.Path, "\\") || strings.Contains(r.URL.RawPath, "%5C") {
        http.Error(w, "Invalid redirect", http.StatusBadRequest)
        return
    }
    // Additional sanitization
    http.Redirect(w, r, r.URL.Path, http.StatusMovedPermanently)
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Caddy 2.4.6 running on a target system.
• A controlled domain (e.g., interact.sh or your own) to receive redirected traffic.

Exploitation Steps:

1. Craft the malicious URL: http://target.com/%5C%5Cattacker.com/%252e%252e%252f
2. Send the URL to a victim via phishing email, social media, or other channels.
3. When the victim clicks the link, Caddy redirects them to http://attacker.com/.
4. The attacker can host a phishing page mimicking the original site to steal credentials.

Nuclei Template Usage: The provided Nuclei template automates detection. Run it against the target:

nuclei -t CVE-2022-28923.yaml -u http://target.com

Blue Team

Detection:

• Monitor web server logs for requests containing %5C, %252e%252e%252f, or backslashes in the path.
• Look for unusual redirect patterns, especially to external domains.

Hunting:

• Search for HTTP responses with Location headers pointing to external domains that were not expected.
• Use the provided YARA and Sigma rules to scan logs.

Lab Setup:

1. Install Caddy 2.4.6 on a test VM.
2. Configure a simple site (e.g., caddy file-server --listen :8080).
3. Send the PoC request using curl:

   curl -v "http://localhost:8080/%5C%5Cinteract.sh/%252e%252e%252f"
   

4. Observe the Location header in the response.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with paths containing %5C%5C or %252e%252e%252f.
  • HTTP responses with Location headers pointing to unexpected external domains.
• Log IOCs:
  • Web server log entries with %5C or \\ in the request URI.
  • Repeated redirects to the same external domain.
• File IOCs:
  • Caddy binary version 2.4.6 (check with caddy version).

Detection Engineering

YARA Rule

rule CVE_2022_28923_Caddy_Open_Redirect {
    meta:
        description = "Detects Caddy open redirect exploitation attempts"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2022-28923"
    strings:
        $redirect_pattern = /%5C%5C[a-zA-Z0-9.-]+%252e%252e%252f/
        $backslash_path = /\\[a-zA-Z0-9.-]+\\/
    condition:
        $redirect_pattern or $backslash_path
}

Sigma Rule

title: Caddy Open Redirect Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests targeting Caddy open redirect vulnerability
author: Valters IT
logsource:
    category: webserver
    product: caddy
detection:
    selection:
        cs-uri-query|contains:
            - '%5C%5C'
            - '%252e%252e%252f'
            - '\\'
    condition: selection
falsepositives:
    - Legitimate use of backslashes in rare cases
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2022-28923 Caddy Open Redirect Attempt"; flow:to_server; content:"%5C%5C"; http_uri; content:"%252e%252e%252f"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2022-28923

info:
  name: Caddy 2.4.6 - Open Redirect
  author: Sascha Brendel,DhiyaneshDk
  severity: medium
  description: |
    Caddy 2.4.6 contains an open redirect vulnerability. An attacker can redirect a user to a malicious site via a crafted URL and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  impact: |
    Successful exploitation of this vulnerability could lead to phishing attacks, credential theft,.
  remediation: |
    Upgrade Caddy to version 2.4.7 or later to mitigate the vulnerability.
  reference:
    - https://lednerb.de/en/publications/responsible-disclosure/caddy-open-redirect-vulnerability/
    - https://www.cve.org/CVERecord?id=CVE-2022-28923
    - https://github.com/caddyserver/caddy/issues/4502
    - https://nvd.nist.gov/vuln/detail/CVE-2022-28923
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-28923
    cwe-id: CWE-601
    epss-score: 0.02912
    epss-percentile: 0.86418
    cpe: cpe:2.3:a:caddyserver:caddy:2.4.6:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: caddyserver
    product: caddy
    shodan-query:
      - 'Server: caddy'
      - "server: caddy"
  tags: cve,cve2022,redirect,caddy,webserver,caddyserver,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/%5C%5Cinteract.sh/%252e%252e%252f'

    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$'

Remediation & Mitigation

Immediate Actions:

1. Upgrade Caddy to version 2.4.7 or later.
2. If immediate upgrade is not possible, implement a reverse proxy (e.g., Nginx) to filter malicious requests:

   if ($request_uri ~* "%5C%5C|%252e%252e%252f|\\\\") {
       return 403;
   }
   

3. Monitor logs for exploitation attempts using the provided detection rules.

Long-term Measures:

• Enforce strict input validation for all redirect endpoints.
• Use a whitelist of allowed redirect domains.
• Regularly update Caddy to the latest stable version.
• Conduct periodic security audits and penetration testing.

Patch Details: The official fix is included in Caddy version 2.4.7. Download from https://github.com/caddyserver/caddy/releases.

Valters IT

{/* [Security Hash: 4E040182FB6FB5D99E6DE137] */}