Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`

Vulnerability

In Caddy, when using forward_auth with copy_headers and php_fastcgi, the copy_headers directive deletes exact client-supplied header names (e.g., Remote-Groups) before setting trusted values from the auth gateway. However, the FastCGI exporter normalizes HTTP header names by replacing hyphens with underscores, so an attacker can send an underscore variant (e.g., Remote_Groups) that survives deletion but collides with the derived CGI variable (e.g., HTTP_REMOTE_GROUPS). This affects all Caddy versions that support forward_auth and php_fastcgi with these configurations [1][2].

Exploitation

An unauthenticated remote attacker sends an HTTP request to a Caddy server that uses forward_auth copy_headers and php_fastcgi. The attacker includes a header with an underscore alias, such as Remote_Groups: injected_value. The copy_headers directive deletes only the exact hyphenated header (e.g., Remote-Groups), leaving the underscore version untouched. When the request is proxied to a PHP backend via FastCGI, both the legitimate header and the attacker's alias are normalized to the same CGI variable (e.g., HTTP_REMOTE_GROUPS), allowing the attacker to override or inject values [1][2].

Impact

A successful attacker can inject arbitrary values into CGI variables that PHP applications typically trust for authentication or authorization decisions, such as user identity or group membership. This can lead to privilege escalation, unauthorized access, or other security breaches depending on how the backend application uses those variables [1][2].

Mitigation

No official patch has been released for this issue as of the publication date. Users are advised to avoid using php_fastcgi with forward_auth copy_headers when identity headers are critical, or implement custom logic to sanitize underscore-alias headers. The vulnerability is distinct from the previously disclosed GHSA-7r4p-vjf4-gxv4 [1][2].