CVE-2022-34037
📋 TL;DR
CVE-2022-34037 is an out-of-bounds read vulnerability in Caddy web server's rewrite module that can cause denial of service. Attackers can crash the server by sending specially crafted URIs. This affects administrators running Caddy with rewrite rules that process malformed request URIs.
💻 Affected Systems
- Caddy
📦 What is this software?
Caddy by Caddyserver
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption where Caddy crashes and stops serving requests, requiring manual restart.
Likely Case
Partial service disruption where specific requests cause empty responses but server remains running.
If Mitigated
No impact if proper rewrite configurations are used and malformed URIs are filtered upstream.
🎯 Exploit Status
Exploitation requires sending crafted URIs to vulnerable rewrite configurations. No public exploit code available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v2.5.2 and later
Vendor Advisory: https://github.com/caddyserver/caddy/issues/4775
Restart Required: Yes
Instructions:
1. Update Caddy to v2.5.2 or later using your package manager or download from caddyserver.com. 2. Restart the Caddy service. 3. Verify the version with 'caddy version'.
🔧 Temporary Workarounds
Remove or fix rewrite rules
allReview and fix rewrite configurations that might process malformed URIs
Review Caddyfile rewrite directives
Test rewrite rules with various URI formats
Implement request filtering
allAdd middleware to filter malformed URIs before they reach rewrite module
Add try_files or other validation middleware in Caddyfile
🧯 If You Can't Patch
- Implement WAF or reverse proxy to filter malformed URIs before they reach Caddy
- Monitor logs for unusual URI patterns and implement rate limiting
🔍 How to Verify
Check if Vulnerable:
Check if running Caddy v2.5.1 with rewrite rules that might process malformed URIsCheck Version:
caddy versionVerify Fix Applied:
Confirm Caddy version is v2.5.2 or later and test with previously problematic URIs📡 Detection & Monitoring
Log Indicators:
- Empty HTTP responses
- Panic logs from rewrite module
- Unusual URI patterns in access logs
Network Indicators:
- HTTP requests with malformed URIs
- Sudden drop in successful responses
SIEM Query:
source="caddy" AND (message="panic" OR status="-" OR uri="*malformed*")