CVE-2019-12524 – This vulnerability allows attackers to bypass S... (How to Fix)

Q: What is the severity of CVE-2019-12524?

CVE-2019-12524 has a CVSS score of 9.8 (CRITICAL). This vulnerability allows attackers to bypass Squid's Cache Manager access controls by URL-encoding their requests. Attackers can access sensitive server information meant only for administrators. All Squid installations through version 4.7 with default configurations are affected.

📋 TL;DR

This vulnerability allows attackers to bypass Squid's Cache Manager access controls by URL-encoding their requests. Attackers can access sensitive server information meant only for administrators. All Squid installations through version 4.7 with default configurations are affected.

💻 Affected Systems

Products:

Squid

Versions: All versions through 4.7

Operating Systems: All operating systems running Squid

Default Config Vulnerable: ⚠️ Yes

Notes: Affects default configurations where Cache Manager access control rules are enabled via url_regex patterns.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers gain administrative access to Cache Manager, exposing detailed server configuration, performance metrics, and potentially sensitive operational data that could facilitate further attacks.

🟠

Likely Case

Unauthorized users access the Cache Manager interface, obtaining server statistics and configuration details that could be used for reconnaissance or to identify other vulnerabilities.

🟢

If Mitigated

With proper network segmentation and access controls, impact is limited to information disclosure within the Squid instance.

🌐 Internet-Facing: HIGH - Squid proxies are often internet-facing, making them directly accessible to attackers who can exploit this unauthenticated bypass.

🏢 Internal Only: MEDIUM - Internal attackers could still exploit this to gain unauthorized access to proxy management information.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires only URL encoding of Cache Manager requests to bypass regex checks. Public technical details available in security advisories.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Squid 4.8 and later

Vendor Advisory: https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html

Restart Required: Yes

Instructions:

1. Update Squid to version 4.8 or later using your distribution's package manager. 2. For Debian/Ubuntu: apt update && apt upgrade squid. 3. For source installations: Download and compile Squid 4.8+. 4. Restart Squid service.

🔧 Temporary Workarounds

Restrict Cache Manager Access via ACL

all

Add explicit ACL rules to block all Cache Manager access regardless of URL encoding

acl manager proto cache_object
http_access deny manager

Disable Cache Manager Interface

all

Completely disable the Cache Manager functionality

cache_mgr none

🧯 If You Can't Patch

Implement network-level access controls to restrict access to Squid management interfaces
Monitor Squid access logs for unusual Cache Manager requests and implement alerting

🔍 How to Verify

Check if Vulnerable:

Check Squid version with 'squid -v' or package manager. If version is 4.7 or earlier, system is vulnerable.

Check Version:

squid -v | grep Version || apt-cache policy squid | grep Installed || rpm -q squid

Verify Fix Applied:

After patching, verify version is 4.8+ and test Cache Manager access with URL-encoded requests should be blocked.

📡 Detection & Monitoring

Log Indicators:

Cache Manager access from unauthorized IPs
URL-encoded requests to /squid-internal-mgr
Failed ACL matches for cache_object protocol

Network Indicators:

HTTP requests with encoded characters targeting Cache Manager endpoints
Unusual traffic to Squid management ports

SIEM Query:

source="squid_access.log" AND (uri="*%2Fsquid-internal-mgr*" OR uri="*cache_object*" OR proto="cache_object")

📊 Metadata

CVE ID: CVE-2019-12524

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-306

Published: April 15, 2020

Last Updated: November 21, 2024

🔗 References

https://gitlab.com/jeriko.one/security/-/blob/master/squid/CVEs/CVE-2019-12524.txt Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html Mailing List,Third Party Advisory
https://security.netapp.com/advisory/ntap-20210205-0006/ Third Party Advisory
https://usn.ubuntu.com/4446-1/ Third Party Advisory
https://www.debian.org/security/2020/dsa-4682 Third Party Advisory
https://gitlab.com/jeriko.one/security/-/blob/master/squid/CVEs/CVE-2019-12524.txt Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html Mailing List,Third Party Advisory
https://security.netapp.com/advisory/ntap-20210205-0006/ Third Party Advisory
https://usn.ubuntu.com/4446-1/ Third Party Advisory
https://www.debian.org/security/2020/dsa-4682 Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2019-12524, you might also want to check these: