Denial of Service in Squid Proxy
Summary
CVE-2023-50269: Squid is a caching proxy for the Web. Affects squid across 3 version ranges.
< 6.6-r0
>= ef1e128ce5a9733ae57d6595806bb832de389446, <= 03c8a93e863f873b5d6ff45adb786db447cabcd6
>= f188960023551b2e9cb2a9df245b92bfeef37056, <= 20d1c7236c7493b1f8b7e47f2e2afc529232071c
Fixed in 6.6-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Squid is a popular caching proxy for the Web. It is used to improve web server performance by caching frequently accessed content. Squid is vulnerable to a Denial of Service (DoS) attack due to an Uncontrolled Recursion bug. This bug affects versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5. The vulnerability arises when Squid is configured with the follow_x_forwarded_for feature and receives a large X-Forwarded-For header from a remote client. This can lead to a DoS attack by exhausting system resources.
Vulnerability Detail
The Uncontrolled Recursion bug in Squid allows remote attackers to trigger a DoS attack by sending a large X-Forwarded-For header. When the follow_x_forwarded_for feature is enabled, Squid recursively parses the X-Forwarded-For header, leading to excessive memory consumption and CPU usage. This can result in the Squid proxy becoming unresponsive and denying service to legitimate users. The vulnerability is fixed in Squid version 6.6.
How To Fix
Minimum fixed version
6.6-r0
This is the first release that contains the fix.
sudo apk add --upgrade squidTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading Squid is not immediately feasible, a temporary workaround is to disable the follow_x_forwarded_for feature in the Squid configuration. By disabling this feature, Squid will not process the X-Forwarded-For header and will not be vulnerable to the DoS attack. However, disabling this feature may impact certain functionality that relies on the X-Forwarded-For header for client identification or logging purposes.
Conclusion
The Uncontrolled Recursion bug in Squid can lead to a Denial of Service attack when a remote client sends a large X-Forwarded-For header. Upgrading Squid to version 6.6 or later is the recommended solution. If immediate upgrade is not possible, disabling the follow_x_forwarded_for feature can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for squid →
FAQ
Squid is a caching proxy for the Web that improves web server performance by caching frequently accessed content.
Versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5 of Squid are vulnerable to this DoS attack.
The DoS attack is triggered by sending a large X-Forwarded-For header to the Squid proxy when the follow_x_forwarded_for feature is enabled. This causes Squid to consume excessive memory and CPU resources, leading to unresponsiveness and denial of service.
Yes, the vulnerability is fixed in Squid version 6.6. It is recommended to upgrade to this version or later to mitigate the risk.
A temporary workaround is to disable the follow_x_forwarded_for feature in the Squid configuration. However, this may impact certain functionality that relies on the X-Forwarded-For header.
Related vulnerabilities
Recent vulnerabilities recorded for squid.
