#VU30257 Improper Authentication in Caddy - CVE-2018-21246

Vulnerability identifier: #VU30257

Vulnerability risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2018-21246

CWE-ID: CWE-287

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Caddy
Web applications / Other software

Vendor: Caddy

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMatching mode.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Caddy: 0.10.0 - 0.10.2

---

External links
https://bugs.gentoo.org/715214
https://github.com/caddyserver/caddy/releases/tag/v0.10.13

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.