CVE-2022-29718

Vulnerability

Caddy v2.4 (and possibly earlier versions) contains an open redirect vulnerability. A remote unauthenticated attacker can craft a link that, when clicked by a victim, redirects them to an arbitrary external URL. The issue is present in the HTTP server's request handling, where insufficient validation of redirect targets allows untrusted user-controlled input to be used as the redirect destination. The vulnerability is publicly known and assigned CVE-2022-29718 [1][3].

Exploitation

An attacker does not require authentication or any special privileges. The exploitation vector is social engineering: the attacker sends a crafted link to a victim (e.g., via email, messaging, or a malicious website). The link is constructed in a way that Caddy's server interprets a portion of the URL as the target for a redirect. When the victim clicks the link and Caddy processes the request, the server responds with an HTTP redirect (e.g., HTTP 302) to an arbitrary attacker-controlled domain. The exact mechanism is not fully detailed in public references, but it relies on Caddy's handling of certain URL patterns that fail to sanitize or validate the redirect host [1][3].

Impact

Successful exploitation results in an open redirect, allowing the attacker to redirect users to any external website. The impact is primarily on user trust and phishing scenarios: the victim sees a legitimate Caddy-hosted domain in the initial URL, but after clicking, they land on an attacker-controlled site. This can be used for credential harvesting, malware distribution, or other social engineering attacks. The vulnerability does not directly lead to server compromise, data disclosure, or privilege escalation on the Caddy server itself [1][3].

Mitigation

The vulnerability is fixed in Caddy v2.5.0, released in the same timeframe as the CVE (June 2022). Users should upgrade to Caddy v2.5.0 or later. No workarounds are provided in the available references [1][3]. The CVE is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date.