Description
Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `path` request matcher is intended to be case-insensitive, but when the match pattern contains percent-escape sequences (`%xx`) it compares against the request's escaped path without lowercasing. An attacker can bypass path-based routing and any access controls attached to that route by changing the casing of the request path. Version 2.11.1 contains a fix for the issue.
Remediation
References
Related Vulnerabilities
Plone CMS Use of Externally-Controlled Format String Vulnerability (CVE-2017-5524)
phpMyAdmin Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-6625)
Oracle Database Server CVE-2006-0258 Vulnerability (CVE-2006-0258)
WordPress Plugin Welcart e-Commerce Multiple Vulnerabilities (1.8.2)