Executive brief
Squid Internet Object Cache, a popular web proxy and cache server, contains a flaw that allows users to bypass security restrictions. By using special character encoding in web addresses, unauthorized users can access restricted websites or content that should be blocked by the organization's access policies. This could lead to unauthorized data access or the bypassing of corporate security filters.
Technical details
A vulnerability in Squid Internet Object Cache 1.1.20 allows for an Access Control List (ACL) bypass. The issue stems from improper normalization of URLs before they are matched against defined ACLs. An attacker can use hexadecimal escape sequences (URL encoding) to represent characters in a URL that would otherwise be blocked by the proxy's security rules. Because the proxy fails to decode these sequences before performing the ACL check, the malicious or restricted URL does not match the blocked patterns and is permitted. This allows unauthenticated remote attackers to access restricted network resources.
Affected products
- Squid Internet Object Cache 1.1.20
Timeline
- 1998-02-20: disclosed