CVE-2019-12523
📋 TL;DR
This Squid vulnerability allows attackers to bypass access controls by making URN requests that trigger HTTP requests without proper authorization checks. Attackers can access restricted HTTP servers, including those only listening on localhost. All Squid installations before version 4.9 are affected.
💻 Affected Systems
- Squid
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Leap by Opensuse
Squid by Squid Cache
Squid by Squid Cache
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Complete bypass of Squid's access controls allowing attackers to reach internal HTTP servers, potentially exposing sensitive internal services or data.
Likely Case
Unauthorized access to internal HTTP services that should be restricted, potentially leading to data exposure or service compromise.
If Mitigated
Limited impact if proper network segmentation and additional firewall rules are in place to restrict access to internal services.
🎯 Exploit Status
Exploitation requires sending specially crafted URN requests to the Squid proxy. Public advisories include technical details that could be used to create exploits.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Squid 4.9 and later
Vendor Advisory: http://www.squid-cache.org/Advisories/SQUID-2019_8.txt
Restart Required: Yes
Instructions:
1. Upgrade Squid to version 4.9 or later. 2. Download from squid-cache.org or use your distribution's package manager. 3. Stop Squid service. 4. Install new version. 5. Restart Squid service.
🔧 Temporary Workarounds
Disable URN handling
allDisable URN protocol support in Squid configuration to prevent exploitation
Add 'urn deny all' to squid.conf
Restrict URN access
allConfigure ACLs to restrict who can make URN requests
Add appropriate ACL rules for URN requests in squid.conf
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Squid proxies from sensitive internal HTTP servers
- Deploy additional firewall rules to restrict Squid's ability to connect to internal HTTP services
🔍 How to Verify
Check if Vulnerable:
Check Squid version with 'squid -v' or 'squid3 -v' and verify if it's below 4.9Check Version:
squid -v || squid3 -vVerify Fix Applied:
After patching, verify version is 4.9 or higher and test URN requests to ensure they now go through proper access checks📡 Detection & Monitoring
Log Indicators:
- Unusual URN request patterns
- HTTP requests from Squid to internal servers that bypass normal access logs
- Access denied messages for URN requests
Network Indicators:
- HTTP traffic from Squid proxy to internal servers that shouldn't be accessible
- Unusual URN protocol traffic patterns
SIEM Query:
source="squid_access.log" AND (uri CONTAINS "urn:" OR method="URN")🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00056.html
- http://www.squid-cache.org/Advisories/SQUID-2019_8.txt
- https://bugzilla.suse.com/show_bug.cgi?id=1156329
- https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTM74TU2BSLT5B3H4F3UDW53672NVLMC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UEMOYTMCCFWK5NOXSXEIH5D2VGWVXR67/
- https://usn.ubuntu.com/4213-1/
- https://usn.ubuntu.com/4446-1/
- https://www.debian.org/security/2020/dsa-4682
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00056.html
- http://www.squid-cache.org/Advisories/SQUID-2019_8.txt
- https://bugzilla.suse.com/show_bug.cgi?id=1156329
- https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTM74TU2BSLT5B3H4F3UDW53672NVLMC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UEMOYTMCCFWK5NOXSXEIH5D2VGWVXR67/
- https://usn.ubuntu.com/4213-1/
- https://usn.ubuntu.com/4446-1/
- https://www.debian.org/security/2020/dsa-4682
