CVE-2019-12520
published 2020-04-15CVE-2019-12520: An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to see if it can serve up a response. It does this by…
PriorityP346high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
3.94%
89.1th percentile
An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to see if it can serve up a response. It does this by making a MD5 hash of the absolute URL of the request. If found, it servers the request. The absolute URL can include the decoded UserInfo (username and password) for certain protocols. This decoded info is prepended to the domain. This allows an attacker to provide a username that has special characters to delimit the domain, and treat the rest of the URL as a path or query string. An attacker could first make a request to their domain using an encoded username, then when a request for the target domain comes in that decodes to the exact URL, it will serve the attacker's HTML instead of the real HTML. On Squid servers that also act as reverse proxies, this allows an attacker to gain access to features that only reverse proxies can use, such as ESI.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | squid | < squid 4.8-1 (bookworm) | squid 4.8-1 (bookworm) |
| squid-cache | squid | <= 4.7 | — |
| squid | squid | >= 0 < 4.8-1 | 4.8-1 |
| squid | squid | >= 0 < 4.8-1 | 4.8-1 |
| squid | squid | >= 0 < 4.8-1 | 4.8-1 |
| squid | squid | >= 0 < 4.8-1 | 4.8-1 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Squid regression
vendor_ubuntu·2020-08-27·CVSS 7.5
[HIGH] Squid regression
Title: Squid regression
Summary: USN-4446-1 introduced a regression in Squid.
USN-4446-1 fixed vulnerabilities in Squid. The update introduced a
regression when using Squid with the icap or ecap protocols. This update
fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Jeriko One discovered that Squid incorrectly handled caching certain
requests. A remote attacker could possibly use this issue to perform
cache-injection attacks or gain access to reverse proxy features such as
ESI. (CVE-2019-12520)
Jeriko One and Kristoffer Danielsson discovered that Squid incorrectly
handled certain URN requests. A remote attacker could possibly use this
issue to bypass access checks. (CVE-2019-12523)
Jeriko One discovered that Squid incorrectly handled URL decoding. A
Ubuntu
Squid vulnerabilities
vendor_ubuntu·2020-08-03·CVSS 7.5
CVE-2019-12520 [HIGH] Squid vulnerabilities
Title: Squid vulnerabilities
Summary: Several security issues were fixed in Squid.
Jeriko One discovered that Squid incorrectly handled caching certain
requests. A remote attacker could possibly use this issue to perform
cache-injection attacks or gain access to reverse proxy features such as
ESI. (CVE-2019-12520)
Jeriko One and Kristoffer Danielsson discovered that Squid incorrectly
handled certain URN requests. A remote attacker could possibly use this
issue to bypass access checks. (CVE-2019-12523)
Jeriko One discovered that Squid incorrectly handled URL decoding. A remote
attacker could possibly use this issue to bypass certain rule checks.
(CVE-2019-12524)
Jeriko One and Kristoffer Danielsson discovered that Squid incorrectly
handled input validation. A remote attacker could use
Red Hat
squid: Improper input validation in request allows for proxy manipulation
vendor_redhat·2020-04-24·CVSS 7.5
CVE-2019-12520 [HIGH] CWE-20 squid: Improper input validation in request allows for proxy manipulation
squid: Improper input validation in request allows for proxy manipulation
An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to see if it can serve up a response. It does this by making a MD5 hash of the absolute URL of the request. If found, it servers the request. The absolute URL can include the decoded UserInfo (username and password) for certain protocols. This decoded info is prepended to the domain. This allows an attacker to provide a username that has special characters to delimit the domain, and treat the rest of the URL as a path or query string. An attacker could first make a request to their domain using an encoded username, then when a request for the target domain comes in that decodes to the exact URL, it will serve the att
Debian
CVE-2019-12520: squid - An issue was discovered in Squid through 4.7 and 5. When receiving a request, Sq...
vendor_debian·2019·CVSS 7.5
CVE-2019-12520 [HIGH] CVE-2019-12520: squid - An issue was discovered in Squid through 4.7 and 5. When receiving a request, Sq...
An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to see if it can serve up a response. It does this by making a MD5 hash of the absolute URL of the request. If found, it servers the request. The absolute URL can include the decoded UserInfo (username and password) for certain protocols. This decoded info is prepended to the domain. This allows an attacker to provide a username that has special characters to delimit the domain, and treat the rest of the URL as a path or query string. An attacker could first make a request to their domain using an encoded username, then when a request for the target domain comes in that decodes to the exact URL, it will serve the attacker's HTML instead of the real HTML. On Squid servers that also act as re
GHSA
GHSA-gx26-q49r-m7g8: An issue was discovered in Squid through 4
ghsa_unreviewed·2022-05-24
CVE-2019-12520 [MEDIUM] CWE-20 GHSA-gx26-q49r-m7g8: An issue was discovered in Squid through 4
An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to see if it can serve up a response. It does this by making a MD5 hash of the absolute URL of the request. If found, it servers the request. The absolute URL can include the decoded UserInfo (username and password) for certain protocols. This decoded info is prepended to the domain. This allows an attacker to provide a username that has special characters to delimit the domain, and treat the rest of the URL as a path or query string. An attacker could first make a request to their domain using an encoded username, then when a request for the target domain comes in that decodes to the exact URL, it will serve the attacker's HTML instead of the real HTML. On Squid servers that also act as re
OSV
squid3 regression
osv·2020-08-27·CVSS 7.5
CVE-2019-12520 [HIGH] squid3 regression
squid3 regression
USN-4446-1 fixed vulnerabilities in Squid. The update introduced a
regression when using Squid with the icap or ecap protocols. This update
fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Jeriko One discovered that Squid incorrectly handled caching certain
requests. A remote attacker could possibly use this issue to perform
cache-injection attacks or gain access to reverse proxy features such as
ESI. (CVE-2019-12520)
Jeriko One and Kristoffer Danielsson discovered that Squid incorrectly
handled certain URN requests. A remote attacker could possibly use this
issue to bypass access checks. (CVE-2019-12523)
Jeriko One discovered that Squid incorrectly handled URL decoding. A remote
attacker could possibly use this issue to bypass certa
OSV
squid3 vulnerabilities
osv·2020-08-03·CVSS 7.5
CVE-2019-12520 [HIGH] squid3 vulnerabilities
squid3 vulnerabilities
Jeriko One discovered that Squid incorrectly handled caching certain
requests. A remote attacker could possibly use this issue to perform
cache-injection attacks or gain access to reverse proxy features such as
ESI. (CVE-2019-12520)
Jeriko One and Kristoffer Danielsson discovered that Squid incorrectly
handled certain URN requests. A remote attacker could possibly use this
issue to bypass access checks. (CVE-2019-12523)
Jeriko One discovered that Squid incorrectly handled URL decoding. A remote
attacker could possibly use this issue to bypass certain rule checks.
(CVE-2019-12524)
Jeriko One and Kristoffer Danielsson discovered that Squid incorrectly
handled input validation. A remote attacker could use this issue to cause
Squid to crash, resulting in a denial of
OSV
CVE-2019-12520: An issue was discovered in Squid through 4
osv·2020-04-15·CVSS 7.5
CVE-2019-12520 [HIGH] CVE-2019-12520: An issue was discovered in Squid through 4
An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to see if it can serve up a response. It does this by making a MD5 hash of the absolute URL of the request. If found, it servers the request. The absolute URL can include the decoded UserInfo (username and password) for certain protocols. This decoded info is prepended to the domain. This allows an attacker to provide a username that has special characters to delimit the domain, and treat the rest of the URL as a path or query string. An attacker could first make a request to their domain using an encoded username, then when a request for the target domain comes in that decodes to the exact URL, it will serve the attacker's HTML instead of the real HTML. On Squid servers that also act as re
No detection rules found.
No public exploits indexed.
http://www.squid-cache.org/Versions/v4/http://www.squid-cache.org/Versions/v4/changesets/https://github.com/squid-cache/squid/commits/v4https://gitlab.com/jeriko.one/security/-/blob/master/squid/CVEs/CVE-2019-12520.txthttps://lists.debian.org/debian-lts-announce/2020/07/msg00009.htmlhttps://security.netapp.com/advisory/ntap-20210205-0006/https://usn.ubuntu.com/4446-1/https://www.debian.org/security/2020/dsa-4682http://www.squid-cache.org/Versions/v4/http://www.squid-cache.org/Versions/v4/changesets/https://github.com/squid-cache/squid/commits/v4https://gitlab.com/jeriko.one/security/-/blob/master/squid/CVEs/CVE-2019-12520.txthttps://lists.debian.org/debian-lts-announce/2020/07/msg00009.htmlhttps://security.netapp.com/advisory/ntap-20210205-0006/https://usn.ubuntu.com/4446-1/https://www.debian.org/security/2020/dsa-4682
2020-04-15
Published