Skip to content

SQUID-2022:1 Exposure of Sensitive Information in Cache Manager

Moderate
yadij published GHSA-rcg9-7fqm-83mq Sep 23, 2022

Package

squid (Squid)

Affected versions

4.9-4.17, 5.0.6-5.6

Patched versions

5.7

Description

Due to inconsistent handling of internal URIs Squid is
vulnerable to Exposure of Sensitive Information about clients
using the proxy.

Severity:

This problem allows a trusted client to directly access cache
manager information bypassing the manager ACL protection.

The available cache manager information contains records of
internal network structure, client credentials, client identity
and client traffic behaviour.

CVSS Score of 6.4
https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:X/RC:C/CR:M/IR:X/AR:X/MAV:X/MAC:L/MPR:L/MUI:X/MS:X/MC:H/MI:X/MA:X&version=3.1

Updated Packages:

This bug is fixed by Squid version 5.7.

In addition, patches addressing this problem for the stable
releases can be found in our patch archives:

Squid 4:

http://www.squid-cache.org/Versions/v4/SQUID-2022_1.patch

Squid 5:

http://www.squid-cache.org/Versions/v5/SQUID-2022_1.patch

If you are using a prepackaged version of Squid then please refer
to the package vendor for availability information on updated
packages.

Determining if your version is vulnerable:

Squid older than 4.9 are not vulnerable.

All Squid-4.9 up to and including 4.14 have not been tested, but
should be assumed to be vulnerable.

All Squid-4.15 up to and including 4.17 are vulnerable.

All Squid-5.0.6 up to and including 5.6 are vulnerable.

Workaround:

Add the following to squid.conf:

acl manager url_regex +i ^[^:]+://[^/]+/squid-internal-mgr/

Contact details for the Squid project:

For installation / upgrade support on binary packaged versions
of Squid: Your first point of contact should be your binary
package vendor.

If you install and build Squid from the original Squid sources
then the [email protected] mailing list is your
primary support point. For subscription details see
http://www.squid-cache.org/Support/mailing-lists.html.

For reporting of non-security bugs in the latest STABLE release
the squid bugzilla database should be used
http://bugs.squid-cache.org/.

For reporting of security sensitive bugs send an email to the
[email protected] mailing list. It's a closed
list (though anyone can post) and security related bug reports
are treated in confidence until the impact has been established.

Credits:

This vulnerability was discovered by Mikhail Evdokimov
(aka konata).

Initial fix by Amos Jeffries of Treehouse Networks Ltd.

Revision history:

2022-04-17 18:30:52 UTC Initial Report
2022-08-08 11:01:47 UTC Initial Fix released
2022-09-23 05:00:00 UTC Advisory Released

END

Severity

Moderate

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVE ID

CVE-2022-41317

Weaknesses

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Learn more on MITRE.

Exposure of Sensitive Information Due to Incompatible Policies

The product's intended functionality exposes information to certain actors in accordance with the developer's security policy, but this information is regarded as sensitive according to the intended security policies of other stakeholders such as the product's administrator, users, or others whose information is being processed. Learn more on MITRE.

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Learn more on MITRE.

Improper Authorization

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Learn more on MITRE.

Exposure of Resource to Wrong Sphere

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource. Learn more on MITRE.

Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. Learn more on MITRE.

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. Learn more on MITRE.