CVE-2020-15811: Input Validation
An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Splitting attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the browser cache and any downstream caches with content from an arbitrary source. Squid uses a string search instead of parsing the Transfer-Encoding header to find chunked encoding. This allows an attacker to hide a second request inside Transfer-Encoding: it is interpreted by Squid as chunked and split out into a second request delivered upstream. Squid will then deliver two distinct responses to the client, corrupting any downstream caches.
Other sources
Squid-Cache Squid is vulnerable to HTTP request splitting attacks, caused by improper input validation in HTTP message processing. A remote attacker could exploit this vulnerability to inject arbitrary HTTP request and cause the browser to send 2 HTTP requests, once the URL is clicked. This would allow the attacker to perform further attacks, such as Web cache poisoning or cross-site scripting.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2020-15811.
What is the severity of CVE-2020-15811?
The severity of CVE-2020-15811 is medium.
What is the affected software?
The affected software is Squid-Cache Squid versions before 4.13 and 5.x before 5.0.4.
What is the impact of this vulnerability?
This vulnerability allows HTTP Request Splitting attacks to succeed against HTTP and HTTPS traffic, leading to cache poisoning.
How can I fix CVE-2020-15811?
To fix CVE-2020-15811, upgrade to Squid version 4.13 or 5.0.4 or later.