Executive brief
Squid, a widely used web proxy and cache, contains a flaw in its 'Collapsed Forwarding' feature. This vulnerability could allow a remote attacker to view private data belonging to other users, potentially including login credentials or sensitive session information. The issue occurs when the proxy mistakenly shares a private response with multiple users who should not have access to it.
Technical details
A vulnerability exists in Squid's Collapsed Forwarding feature due to incorrect comparison of HTTP request headers. When multiple clients request the same resource simultaneously, Squid may fail to distinguish between requests that require unique, private responses and those that can be satisfied by a shared cached response. An attacker can exploit this to intercept sensitive information, such as session cookies or credentials, from other users' browsing sessions. The vulnerability specifically affects Squid versions 3.5.0.1 through 3.5.22 and 4.0.1 through 4.0.16 when 'collapsed_forwarding' is enabled. It is fixed in versions 3.5.23 and 4.0.17.
Affected products
- Squid-Cache Squid 3.5.0.1 through 3.5.22, 4.0.1 through 4.0.16
Timeline
- 2016-11-28: other: Initial report by Felix Hassert
- 2016-12-16: patched: Squid versions 3.5.23 and 4.0.17 released
- 2016-12-16: advisory: SQUID-2016:10 published
- 2017-01-27: disclosed: NVD publication date