Travis Peters
Summary: Trail of Bits published an additional set of custom Semgrep rules, bringing its total number of public rules to 115, and the post covers regex mode versus generic mode and HCL language support. The same page also references a September 18, 2023 audit in which the firm identified 10 security vulnerabilities in the caddy-security SSO plugin for the Caddy web server, including client-side code execution, OAuth replay attacks, and unauthorized access to resources.
Bottom line: Ten vulnerabilities in a single SSO plugin for a reverse proxy put authentication and resource access in the blast radius, and OAuth replay attacks are the kind of flaw that survives a correct password.
Read the original at Trail of Bits Blog ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026