Squid Proxy 3.1.19 HTTP Header Host Field Parser CONNECT Request access control ⚔ [Disputed]

Summaryinfo

A vulnerability labeled as critical has been found in Squid Proxy 3.1.19. The affected element is an unknown function of the component HTTP Header Host Field Parser. Executing a manipulation as part of CONNECT Request can lead to access control. This vulnerability is handled as CVE-2012-2213. Additionally, an exploit exists. This vulnerability has a historic impact due to its background and reception. The presence of this vulnerability remains uncertain at this time. The application of restrictive firewalling is recommended.

Detailsinfo

A vulnerability classified as critical was found in Squid Proxy 3.1.19 (Firewall Software). This vulnerability affects an unknown part of the component HTTP Header Host Field Parser. The manipulation as part of a CONNECT Request leads to a access control vulnerability. The CWE definition for the vulnerability is CWE-264. As an impact it is known to affect integrity. CVE summarizes:

** DISPUTED ** Squid 3.1.9 allows remote attackers to bypass the access configuration for the CONNECT method by providing an arbitrary allowed hostname in the Host HTTP header. NOTE: this issue might not be reproducible, because the researcher is unable to provide a squid.conf file for a vulnerable system, and the observed behavior is consistent with a squid.conf file that was (perhaps inadvertently) designed to allow access based on a "req_header Host" acl regex that matches www.uol.com.br.

The weakness was released 04/13/2012 by Gabriel Menezes Nunes as not defined mailinglist post (Bugtraq). The advisory is shared for download at seclists.org. The public release happened without coordination with the vendor. This vulnerability was named CVE-2012-2213 since 04/06/2012. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are unknown but a public exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 08/06/2024). The MITRE ATT&CK project declares the attack technique as T1068. This vulnerability has a historic impact due to its background and reception.

A public exploit has been developed by Gabriel Menezes Nunes in Python and been published immediately after the advisory. It is possible to download the exploit at seclists.org. It is declared as proof-of-concept. As 0-day the estimated underground price was around $5k-$25k. The real existence of this vulnerability is still doubted at the moment.

Proper firewalling of is able to address this issue.

The vulnerability is also documented in the vulnerability database at OSVDB (81164†). Additional details are provided at packetstormsecurity.org. Entry connected to this vulnerability is available at VDB-5177. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Firewall Software

Vendor

• Squid

Name

• Proxy

Version

• 3.1.19

License

• open-source

Website

• Vendor: http://www.squid-cache.org/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion