HTTP Request Splitting Vulnerability in Squid Package
Summary
ALPINE-CVE-2020-15811: An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Affects squid versions < 4.13-r0. Fixed in 4.13-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Squid is a widely-used caching proxy for the web that supports HTTP, HTTPS, and FTP protocols. It is designed to improve web performance by caching frequently requested content, thereby reducing bandwidth usage and improving response times. However, Squid has been found to be vulnerable to an HTTP Request Splitting attack, which can lead to cache poisoning and security breaches.
Vulnerability Detail
An issue was discovered in Squid before version 4.13 and in 5.x before 5.0.4. The vulnerability arises from incorrect data validation, allowing attackers to exploit HTTP Request Splitting attacks against both HTTP and HTTPS traffic. This can result in cache poisoning, enabling any client, including malicious browser scripts, to bypass local security measures and poison the browser cache and any downstream caches with content from arbitrary sources. The flaw is due to Squid's reliance on string search instead of properly parsing the Transfer-Encoding header, which can lead to the interpretation of a second request hidden within the Transfer-Encoding, resulting in two distinct responses being delivered to the client and corrupting downstream caches.
How To Fix
Minimum fixed version
4.13-r0
This is the first release that contains the fix.
sudo apk add --upgrade squidTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can disable the use of chunked transfer encoding in your Squid configuration to mitigate the risk of this vulnerability. This can be done by adding the following line to your Squid configuration file (usually located at /etc/squid/squid.conf): http_port 3128 no_chunked_encoding.
Conclusion
The HTTP Request Splitting vulnerability in the Squid package poses significant risks, including cache poisoning and potential security breaches. It is essential to update to the latest patched versions to mitigate these risks effectively. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for squid →
FAQ
HTTP Request Splitting is a type of attack where an attacker sends a specially crafted HTTP request that splits into two separate requests, potentially leading to cache poisoning and other security issues.
You can check the version of your Squid installation. If it is before version 4.13 or 5.x before 5.0.4, it is vulnerable to this issue.
The consequences include cache poisoning, where attackers can manipulate cached content, leading to security breaches and the delivery of malicious content to users.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
The CVSS score for this vulnerability is 6.5, indicating a medium severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for squid.
