Denial of Service Vulnerability in Squid Proxy (CVE-2023-50269)
Summary
ALPINE-CVE-2023-50269: Squid is a caching proxy for the Web. Affects squid versions < 6.6-r0. Fixed in 6.6-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Squid is a widely used caching proxy for the Web, designed to improve web performance by caching frequently accessed content. It supports various protocols and features, including the ability to handle HTTP requests efficiently. However, certain versions of Squid are susceptible to a Denial of Service (DoS) vulnerability due to improper handling of large HTTP headers, specifically the X-Forwarded-For header when the follow_x_forwarded_for feature is enabled.
Vulnerability Detail
The vulnerability, identified as CVE-2023-50269, arises from an Uncontrolled Recursion bug present in Squid versions 2.6 through 2.7.STABLE9, 3.1 through 5.9, and 6.0.1 through 6.5. This flaw allows a remote attacker to exploit the HTTP request parsing mechanism by sending a maliciously crafted large X-Forwarded-For header. If successful, this can lead to a Denial of Service condition, causing the Squid proxy to become unresponsive, thereby disrupting service for legitimate users.
How To Fix
Minimum fixed version
6.6-r0
This is the first release that contains the fix.
sudo apk add --upgrade squidTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the follow_x_forwarded_for feature in their Squid configuration to mitigate the risk of exploitation until the package can be updated. This can be done by modifying the Squid configuration file (usually located at /etc/squid/squid.conf) and commenting out or removing the relevant directive.
Conclusion
CVE-2023-50269 presents a significant risk to users of Squid versions 2.6 through 2.7.STABLE9, 3.1 through 5.9, and 6.0.1 through 6.5 due to its potential for Denial of Service attacks. It is crucial for users to update to version 6.6 or later to mitigate this vulnerability effectively.
See every vulnerability recorded for squid →
FAQ
CVE-2023-50269 is a vulnerability in Squid that allows for Denial of Service attacks through improper handling of large HTTP headers.
The affected versions include Squid 2.6 to 2.7.STABLE9, 3.1 to 5.9, and 6.0.1 to 6.5.
You can check your Squid version by running the command squid -v in your terminal.
The CVSS score for CVE-2023-50269 is 7.5, indicating a high severity level.
Vulert monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json, providing real-time insights without requiring code access.
References
Related vulnerabilities
Recent vulnerabilities recorded for squid.
