80 行
5.7 KiB
JSON
80 行
5.7 KiB
JSON
{
|
|
"canonical_id": "caddy--CVE-2026-27586",
|
|
"system_id": "caddy",
|
|
"display_name": "Caddy",
|
|
"category": "servers",
|
|
"advisory_mode": "server",
|
|
"title": "Caddy: mTLS client authentication silently fails open when CA certificate file is missing or malformed",
|
|
"summary": "### Summary\n\nTwo swallowed errors in `ClientAuthentication.provision()` cause mTLS client certificate authentication to silently fail open when a CA certificate file is missing, unreadable, or malformed. The server starts without error but accepts any client certificate signed by any system-trusted CA, completely bypassing the intended private CA trust boundary.\n\n### Details\n\nIn `modules/caddytls/connpolicy.go`, the `provision()` method has two `return nil` statements that should be `return err`:\n\n**Bug #1 \u2014 line 787:**\n```go\nders, err := convertPEMFilesToDER(fpath)\nif err != nil {\n return nil // BUG: should be \"return err\"\n}\n```\n\n**Bug #2 \u2014 line 800:**\n```go\nerr := caPool.Provision(ctx)\nif err != nil {\n return nil // BUG: should be \"return err\"\n}\n```\n\nCompare with line 811 which correctly returns the error:\n```go\ncaRaw, err := ctx.LoadModule(clientauth, \"CARaw\")\nif err != nil {\n return err // CORRECT\n}\n```\n\nWhen the error is swallowed on line 787, the chain is:\n\n1. `TrustedCACerts` remains empty (no DER data appended from the file)\n2. The `len(clientauth.TrustedCACerts) > 0` guard on line 794 is false \u2014 skipped\n3. `clientauth.CARaw` is nil \u2014 line 806 returns nil\n4. `clientauth.ca` remains nil \u2014 no CA pool was created\n5. `provision()` returns nil \u2014 caller thinks provisioning succeeded\n\nThen in `ConfigureTLSConfig()`:\n\n6. `Active()` returns true because `TrustedCACertPEMFiles` is non-empty\n7. Default mode is set to `RequireAndVerifyClientCert` (line 860)\n8. But `clientauth.ca` is nil, so `cfg.ClientCAs` is never set (line 867 skipped)\n9. Go's `crypto/tls` with `RequireAndVerifyClientCert` + nil `ClientCAs` verifies client certs against the **system root pool** instead of the intended CA\n\nThe fix is changing `return nil` to `return err` on lines 787 and 800.\n\n### PoC\n\n1. Configure Caddy with mTLS pointing to a nonexistent CA file:\n\n```\n{\n \"apps\": {\n \"http\": {\n \"servers\": {\n \"srv0\": {\n \"listen\": [\":443\"],\n \"tls_connection_policies\": [{\n \"client_authentication\": {\n \"trusted_ca_certs_pem_files\": [\"/nonexistent/ca.pem\"]\n }\n }]\n }\n }\n }\n }\n}\n```\n\n2. Start Caddy \u2014 it starts without any error or warning.\n\n3. Connect with any client certificate (even self-signed):\n```bash\nopenssl s_client -connect localhost:443 -cert client.pem -key client-key.pem\n```\n\n4. The TLS handshake succeeds despite the certificate not being signed by the intended CA.\n\nA full Go test that proves the bug end-to-end (including a successful TLS handshake with a random self-signed client cert) is here: https://gist.github.com/moscowchill/9566c79c76c0b64c57f8bd0716f97c48\n\nTest output:\n```\n=== RUN TestSwallowedErrorMTLSFailOpen\n BUG CONFIRMED: provision() swallowed the error from a nonexistent CA file.\n tls.Config has RequireAndVerifyClientCert but ClientCAs is nil.\n CRITICAL: TLS handshake succeeded with a self-signed client cert!\n The server accepted a client certificate NOT signed by the intended CA.\n--- PASS: TestSwallowedErrorMTLSFailOpen (0.03s)\n```\n\n### Impact\n\nAny deployment using `trusted_ca_cert_file` or `trusted_ca_certs_pem_files` for mTLS will silently degrade to accepting any system-trusted client certificate if the CA file becomes unavailable. This can happen due to a typo in the path, file rotation, corruption, or permission changes. The server gives no indication that mTLS is misconfigured.",
|
|
"published_at": "2026-02-24T20:22:53Z",
|
|
"updated_at": "2026-02-27T19:52:41Z",
|
|
"severity": "medium",
|
|
"cvss_score": 4.0,
|
|
"exploit_status": "unknown",
|
|
"source_confidence": "official",
|
|
"official_source_url": "https://github.com/caddyserver/caddy/security/advisories/GHSA-hffm-g8v7-wrv7",
|
|
"secondary_source_urls": [
|
|
"https://nvd.nist.gov/vuln/detail/CVE-2026-27586",
|
|
"https://github.com/caddyserver/caddy/commit/d42d39b4bc237c628f9a95363b28044cb7a7fe72",
|
|
"https://gist.github.com/moscowchill/9566c79c76c0b64c57f8bd0716f97c48",
|
|
"https://github.com/caddyserver/caddy",
|
|
"https://github.com/caddyserver/caddy/releases/tag/v2.11.1",
|
|
"https://pkg.go.dev/vuln/GO-2026-4539"
|
|
],
|
|
"aliases": [
|
|
"CVE-2026-27586",
|
|
"GO-2026-4539",
|
|
"GHSA-hffm-g8v7-wrv7"
|
|
],
|
|
"cve_ids": [
|
|
"CVE-2026-27586"
|
|
],
|
|
"ghsa_ids": [
|
|
"GHSA-hffm-g8v7-wrv7"
|
|
],
|
|
"osv_ids": [
|
|
"GHSA-hffm-g8v7-wrv7",
|
|
"GO-2026-4539"
|
|
],
|
|
"affected_versions": [
|
|
"introduced=0, fixed<2.11.1"
|
|
],
|
|
"fixed_versions": [
|
|
"2.11.1"
|
|
],
|
|
"package_name": "github.com/caddyserver/caddy/v2",
|
|
"render_markdown": false,
|
|
"case_path": null,
|
|
"secure_code_topics": [
|
|
"proxy-trust-boundary",
|
|
"request-smuggling-boundary",
|
|
"plugin-extension-trust-policy"
|
|
],
|
|
"status": "generated",
|
|
"triage_reasons": [],
|
|
"verification_status": "triage-manual",
|
|
"verification_mode": "synthetic",
|
|
"last_verified_at": null,
|
|
"last_run_id": null,
|
|
"evidence_bundle": null,
|
|
"historical_status": null,
|
|
"latest_status": null,
|
|
"browser_evidence": {
|
|
"required": false,
|
|
"present": false,
|
|
"refs": []
|
|
},
|
|
"repro_profile_id": "authz-bypass-generic",
|
|
"artifact_mode": "synthetic",
|
|
"blocked_reason": null,
|
|
"metadata": {
|
|
"source_names": [
|
|
"OSV Caddy"
|
|
],
|
|
"source_kinds": [
|
|
"osv-batch"
|
|
],
|
|
"candidate_count": 2
|
|
}
|
|
}
|