Caddy: Improper sanitization of glob characters in file matcher may lead to bypassing security protections

QFinch assessment

The path sanitization in file matcher doesn't sanitize backslashes which can lead to bypassing path related security protections.

Potential impact

This vulnerability may allow an attacker to bypass security protections. It affects users with specific Caddy and environment configurations.

Technical context

The tryfiles directive is used to rewrite the request uri. It accepts a list of patterns and checks if any files exist in the root that match the provided patterns. It's commonly used in Caddy configs. For example, it's used in SPA applications to rewrite every route that doesn't exist as a file to index.html. the request path and then is expanded by fs.Glob. The request path is sanitized before being placed inside the pattern and the special chars are escaped . The following code is the sanitization part. The problem here is that it does not escape backslashes. /something-\/ can match a file named something-\-anything.txt, but it should not. The primitive that this vulnerability provides is not very useful, as it only allows an attacker to guess filenames that contain a backslash and they should also know the characters before that backslash. The backslash is mainly used to escape special characters in glob patterns, but when it appears before non special characters, it is ignored. This means that h\ello matches hello world even though e is not a special character. This behavior can be abused to bypass path protections that might be in place. For example, if there is a reverse proxy that only allows /documents/ to the internal network and its upstream is a Caddy server that uses tryfiles, the reverse proxy's protection can be bypassed by requesting the path /do%5ccuments/. Some configurations that implement blacklisting and serving together in Caddy are also vulnerable but there's a condition that the tryfiles directive and the filtering route/handle must not be in a same block because tryfiles directive executes before route and handle directives. For example the following config isn't vulnerable. But this one is vulnerable. This config is also vulnerable because Header directives executes before tryfiles.