CVE-2024-21497 Open Redirect in github.com/greenpau/caddy-security

Medium 5.4 Published 17 Feb 2024 Updated 3 Mar 2026

Attackers can trick users into visiting malicious sites via crafted URLs in the Caddy security plugin, facilitating phishing attacks.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2024-21497?

CVE-2024-21497 is a medium-severity vulnerability in github.com/greenpau/caddy-security, published on 17 Feb 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Versions of the package github.com/greenpau/caddy-security are vulnerable to Open Redirect via the redirect_url parameter. An attacker could perform a phishing attack and trick users into visiting a malicious website by crafting a convincing URL with this parameter. To exploit this vulnerability, the user must take an action, such as clicking on a portal button or using the browser’s back button, to trigger the redirection.

Weakness: CWE-601

Which versions are affected by CVE-2024-21497?

3 open source packages ship an affected version, including github.com/greenpau/caddy-security. It affects 1 product.

Package	Affected	Fixed in
`github.com/greenpau/caddy-security` Go	All versions	None
`github.com/greenpau/caddy-security` Go	All versions to `1.1.23`	None
`github.com/greenpau/caddy-security` Go	All versions to `1.1.23`	None

Products include Greenpau Caddy-Security.

How do I fix CVE-2024-21497?

No fix has been published for CVE-2024-21497 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-21497 being exploited?

There is no known exploitation of CVE-2024-21497 in the wild and no public exploit code.

Sources

Also known as GHSA-8hp3-rmr7-xh88, GO-2024-2560.