HTTP Request Smuggling Vulnerability in Squid Package
Summary
ALPINE-CVE-2020-15810: An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Affects squid versions < 4.13-r0. Fixed in 4.13-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Squid is a widely-used caching proxy for the web that supports HTTP, HTTPS, and FTP protocols. It is designed to improve web performance by caching frequently requested content, reducing bandwidth usage, and enhancing security through access control. However, Squid has been found to have a vulnerability that allows for HTTP Request Smuggling attacks, which can compromise the integrity of cached content.
Vulnerability Detail
An issue was discovered in Squid before version 4.13 and in 5.x before 5.0.4, where incorrect data validation can lead to HTTP Request Smuggling attacks against both HTTP and HTTPS traffic. This vulnerability allows attackers to bypass local security measures and poison the proxy cache, potentially affecting downstream caches with malicious content. The vulnerability arises when Squid is configured for relaxed header parsing, which is the default setting. In this configuration, Squid relays headers containing whitespace characters to upstream servers, leading to conflicts in Content-Length headers and allowing for cache poisoning.
How To Fix
Minimum fixed version
4.13-r0
This is the first release that contains the fix.
sudo apk add --upgrade squidTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling relaxed header parsing in your Squid configuration. This can be done by modifying the Squid configuration file (usually located at /etc/squid/squid.conf) and setting the appropriate directives to enforce stricter header validation.
Conclusion
The Squid package has a significant vulnerability that allows for HTTP Request Smuggling attacks, which can lead to cache poisoning and potential security breaches. It is crucial to update to the latest patched version or implement workarounds to protect your application from this risk.
See every vulnerability recorded for squid →
FAQ
HTTP Request Smuggling is a technique used by attackers to send malicious requests to a server by exploiting discrepancies in how different servers interpret HTTP requests.
If your application uses Squid as a proxy, this vulnerability can allow attackers to poison your cache with malicious content, potentially compromising user data and application integrity.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 6.5, indicating a moderate level of severity.
If you cannot update the package right away, consider implementing the suggested workaround of disabling relaxed header parsing to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for squid.
