X-Forwarded-Proto Header Manipulation

[ahpaleus]

Severity: Low

The processing of the X-Forwarded-Proto header results in redirection to the injected protocol. While this scenario may have limited impact, improper handling of such headers could result in unpredictable security risks, such as bypass of security mechanisms or confusion in handling TLS.

GET /portal HTTP/2
Host: portal.caddysecurity.network
X-Forwarded-Proto: evil_protocol
Content-Length: 2

HTTP/2 302 Found
Cache-Control: no-store
Location: evil_protocol://portal.caddysecurity.network:443/login
Pragma: no-cache
Server: Fly/a0b91024 (2023-06-13)
Set-Cookie: AUTHP_SESSION_ID=xyz; Domain=caddysecurity.network; Path=/; Secure; HttpOnly;
Date: Wed, 19 Jul 2023 08:46:00 GMT
Content-Length: 0

To address this issue, do not rely on the X-Forwarded-Proto header. If it is required, validate the value of the X-Forwarded-Proto header against an allowlist of accepted protocols (e.g., HTTP/HTTPS) and reject unexpected values.

More information about our Caddy Security public disclosure:

• https://blog.trailofbits.com/2023/09/18/security-flaws-in-an-sso-plugin-for-caddy/