CVE-2023-46846
📋 TL;DR
CVE-2023-46846 is an HTTP request smuggling vulnerability in Squid proxy due to lenient chunked decoder handling. It allows attackers to bypass security controls like firewalls and frontend systems by smuggling malicious requests. Organizations using vulnerable Squid versions as reverse proxies or caching servers are affected.
💻 Affected Systems
- Squid
📦 What is this software?
Enterprise Linux For Ibm Z Systems by Redhat
View all CVEs affecting Enterprise Linux For Ibm Z Systems →
Enterprise Linux For Power Little Endian by Redhat
View all CVEs affecting Enterprise Linux For Power Little Endian →
Squid by Squid Cache
⚠️ Risk & Real-World Impact
Worst Case
Attackers could bypass security controls, inject malicious content, perform cache poisoning, or conduct web application attacks against backend systems that would normally be blocked.
Likely Case
Request smuggling to bypass security filters, potentially leading to web application attacks, cache poisoning, or unauthorized access to internal resources.
If Mitigated
Limited impact with proper network segmentation, WAF protection, and monitoring in place to detect smuggling attempts.
🎯 Exploit Status
Exploitation requires understanding of HTTP request smuggling techniques but tools exist to automate attacks.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Squid 5.7.1, 6.0.2, or later
Vendor Advisory: https://access.redhat.com/errata/RHSA-2023:6266
Restart Required: Yes
Instructions:
1. Check current Squid version. 2. Update to Squid 5.7.1, 6.0.2 or later using package manager. 3. Restart Squid service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Disable chunked encoding
linuxConfigure Squid to reject chunked transfer encoding requests
Add 'request_header_access Transfer-Encoding deny all' to squid.conf
Use strict parsing mode
linuxEnable strict HTTP parsing in Squid configuration
Add 'http_port 3128 require-proxy-header' to squid.conf
🧯 If You Can't Patch
- Implement network segmentation to isolate Squid instances from critical backend systems
- Deploy WAF with HTTP request smuggling detection capabilities in front of Squid
🔍 How to Verify
Check if Vulnerable:
Check Squid version with 'squid -v' or 'rpm -q squid' and compare to affected versions (5.0.4-5.7, 6.0.0-6.0.1)Check Version:
squid -v | grep Version || rpm -q squid || dpkg -l | grep squidVerify Fix Applied:
Verify version is 5.7.1, 6.0.2 or later and test with HTTP request smuggling tools📡 Detection & Monitoring
Log Indicators:
- Multiple requests with same connection ID
- Malformed chunked encoding headers
- Unexpected request sequences
Network Indicators:
- HTTP requests with unusual chunked encoding patterns
- Requests bypassing expected security controls
SIEM Query:
source="squid" AND ("Transfer-Encoding: chunked" OR "chunked" AND "malformed")🔗 References
- https://access.redhat.com/errata/RHSA-2023:6266
- https://access.redhat.com/errata/RHSA-2023:6267
- https://access.redhat.com/errata/RHSA-2023:6268
- https://access.redhat.com/errata/RHSA-2023:6748
- https://access.redhat.com/errata/RHSA-2023:6801
- https://access.redhat.com/errata/RHSA-2023:6803
- https://access.redhat.com/errata/RHSA-2023:6804
- https://access.redhat.com/errata/RHSA-2023:6810
- https://access.redhat.com/errata/RHSA-2023:7213
- https://access.redhat.com/errata/RHSA-2024:11049
- https://access.redhat.com/security/cve/CVE-2023-46846
- https://bugzilla.redhat.com/show_bug.cgi?id=2245910
- https://github.com/squid-cache/squid/security/advisories/GHSA-j83v-w3p4-5cqh
- https://access.redhat.com/errata/RHSA-2023:6266
- https://access.redhat.com/errata/RHSA-2023:6267
- https://access.redhat.com/errata/RHSA-2023:6268
- https://access.redhat.com/errata/RHSA-2023:6748
- https://access.redhat.com/errata/RHSA-2023:6801
- https://access.redhat.com/errata/RHSA-2023:6803
- https://access.redhat.com/errata/RHSA-2023:6804
- https://access.redhat.com/errata/RHSA-2023:6810
- https://access.redhat.com/errata/RHSA-2023:7213
- https://access.redhat.com/security/cve/CVE-2023-46846
- https://bugzilla.redhat.com/show_bug.cgi?id=2245910
- https://github.com/squid-cache/squid/security/advisories/GHSA-j83v-w3p4-5cqh
- https://lists.debian.org/debian-lts-announce/2024/01/msg00003.html
- https://lists.debian.org/debian-lts-announce/2024/01/msg00008.html
- https://security.netapp.com/advisory/ntap-20231130-0002/
