Security flaws in an SSO plugin for Caddy

By Maciej Domanski, Travis Peters, and David Pokora We identified 10 security vulnerabilities within the caddy-security plugin for the Caddy web server that could enable a variety of high-severity attacks in web applications, including client-side code execution, OAuth replay attacks, and unauthorized access to resources. During our evaluation, Caddy was deployed as a reverse proxy […]

access applications attacks audits client client-side code code execution dynamic analysis enable evaluation exploits flaws go high mitigations oauth plugin program analysis replay resources security security flaws semgrep server severity sso static analysis travis unauthorized access vulnerabilities web web applications web server