CVE-2024-37894
📋 TL;DR
Squid caching proxy versions 6.0.1 through 6.9 and 5.0.5 through 5.9 are vulnerable to memory corruption due to an out-of-bounds write error when assigning ESI variables. This vulnerability can be exploited to cause denial of service, potentially crashing Squid instances. Organizations using vulnerable Squid versions as web proxies are affected.
💻 Affected Systems
- Squid caching proxy
📦 What is this software?
Squid by Squid Cache
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption with Squid process crashes leading to proxy service unavailability, potentially affecting all web traffic through the proxy.
Likely Case
Denial of service through Squid crashes requiring service restarts, causing temporary web proxy service interruptions.
If Mitigated
Limited impact with quick detection and restart capabilities, though service interruptions may still occur during exploitation attempts.
🎯 Exploit Status
Exploitation requires sending specially crafted HTTP requests to trigger the ESI variable assignment bug. No authentication is required if Squid is accessible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Squid 6.10 and 5.10
Vendor Advisory: https://github.com/squid-cache/squid/security/advisories/GHSA-wgvf-q977-9xjg
Restart Required: Yes
Instructions:
1. Download Squid 6.10 or 5.10 from official sources. 2. Stop Squid service. 3. Backup configuration files. 4. Install updated version. 5. Restart Squid service.
🔧 Temporary Workarounds
Disable ESI processing
allDisable Edge Side Includes processing to prevent exploitation of the vulnerability
Add 'esi_disable on' to squid.conf and restart squid
Restrict access to Squid
allLimit which clients can access Squid to reduce attack surface
Configure ACLs in squid.conf to restrict access to trusted networks only
🧯 If You Can't Patch
- Implement network segmentation to isolate Squid instances from untrusted networks
- Deploy WAF or reverse proxy in front of Squid to filter malicious requests
🔍 How to Verify
Check if Vulnerable:
Check Squid version with 'squid -v' and verify if it falls within affected ranges (6.0.1-6.9 or 5.0.5-5.9)Check Version:
squid -v | grep VersionVerify Fix Applied:
Verify Squid version is 6.10 or higher, or 5.10 or higher after patching📡 Detection & Monitoring
Log Indicators:
- Multiple segmentation fault or crash entries in squid logs
- Unusual ESI processing errors
- Service restart patterns
Network Indicators:
- HTTP requests with malformed ESI components
- Unusual traffic patterns to Squid ESI endpoints
SIEM Query:
source="squid_access.log" AND (error OR crash OR segmentation)🔗 References
- https://github.com/squid-cache/squid/commit/f411fe7d75197852f0e5ee85027a06d58dd8df4c.patch
- https://github.com/squid-cache/squid/security/advisories/GHSA-wgvf-q977-9xjg
- https://security.netapp.com/advisory/ntap-20240719-0001/
- https://github.com/squid-cache/squid/commit/f411fe7d75197852f0e5ee85027a06d58dd8df4c.patch
- https://github.com/squid-cache/squid/security/advisories/GHSA-wgvf-q977-9xjg
- https://lists.debian.org/debian-lts-announce/2025/03/msg00009.html
- https://security.netapp.com/advisory/ntap-20240719-0001/
