CVE-2020-36420
📋 TL;DR
CVE-2020-36420 is a denial-of-service vulnerability in Polipo, a caching web proxy, caused by a reachable assertion failure when parsing a malformed Range HTTP header. This allows attackers to crash the Polipo service, disrupting proxy functionality. It affects users running unsupported versions of Polipo with NDEBUG omitted during compilation.
💻 Affected Systems
- Polipo
📦 What is this software?
Polipo by Polipo Project
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service, rendering the Polipo proxy unavailable and disrupting network traffic for dependent clients.
Likely Case
Service crash requiring manual restart, causing temporary proxy unavailability.
If Mitigated
Minimal impact if Polipo is not internet-facing or if vulnerable versions are not in use.
🎯 Exploit Status
Exploitation involves sending a crafted HTTP request with a malformed Range header, making it simple to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 4d42ca1b5849518762d110f34b6ce2e03d6df9ec, but no official release version exists as Polipo is unsupported.
Vendor Advisory: https://github.com/jech/polipo/commit/4d42ca1b5849518762d110f34b6ce2e03d6df9ec
Restart Required: Yes
Instructions:
1. Apply the patch from the GitHub commit manually. 2. Recompile Polipo with the patch. 3. Restart the Polipo service to apply changes.
🔧 Temporary Workarounds
Block Malformed Range Headers
allUse a web application firewall or proxy filter to block HTTP requests with malformed Range headers.
Depends on specific WAF or proxy configuration; no universal command.
Disable Polipo or Use Alternative
linuxStop using Polipo and switch to a supported caching proxy like Squid or Varnish.
sudo systemctl stop polipo
sudo systemctl disable polipo
🧯 If You Can't Patch
- Restrict network access to Polipo to trusted internal networks only.
- Monitor logs for crash events and implement automated restart scripts to minimize downtime.
🔍 How to Verify
Check if Vulnerable:
Check if Polipo version is 1.1.1 or earlier and if it was compiled without NDEBUG. Review build logs or use 'polipo -v' and inspect compilation flags.Check Version:
polipo -vVerify Fix Applied:
Verify the patch is applied by checking the source code for the fix from commit 4d42ca1b5849518762d110f34b6ce2e03d6df9ec, then test with a malformed Range header to ensure no crash occurs.📡 Detection & Monitoring
Log Indicators:
- Polipo service crash logs, assertion failure messages in system logs.
Network Indicators:
- HTTP requests with malformed Range headers directed at Polipo ports.
SIEM Query:
Search for events like 'polipo crashed' or 'assertion failed' in service logs, combined with source IPs sending unusual HTTP requests.🔗 References
- http://www.openwall.com/lists/oss-security/2021/07/18/1
- https://bugs.gentoo.org/755896
- https://github.com/jech/polipo/commit/4d42ca1b5849518762d110f34b6ce2e03d6df9ec
- https://www.openwall.com/lists/oss-security/2020/11/18/1
- http://www.openwall.com/lists/oss-security/2021/07/18/1
- https://bugs.gentoo.org/755896
- https://github.com/jech/polipo/commit/4d42ca1b5849518762d110f34b6ce2e03d6df9ec
- https://www.openwall.com/lists/oss-security/2020/11/18/1
