Hostname Enumeration Vulnerability in Caddy Web Server

CVE-2018-19148

What is CVE-2018-19148?

Caddy versions up to 0.11.0 contain a vulnerability where incorrect certificates are sent for certain invalid requests. When the server cannot find a matching Host header, it responds with an X.509 certificate from a randomly selected virtual host configuration. This flaw allows attackers to perform repeated requests using nonexistent hostnames, which can lead to the enumeration of all certificates hosted on the server. The knowledge gained can enable attackers to identify hidden hostnames, thereby revealing potentially sensitive relationships among them.

References