CVE-2019-12520: 
Squid vulnerability analysis and mitigation

A vulnerability (CVE-2019-12520) was discovered in Squid through versions 4.7 and 5. The issue relates to how Squid handles request caching and URL processing. When receiving a request, Squid creates an MD5 hash of the absolute URL to check its cache. The vulnerability exists because the absolute URL can include decoded UserInfo (username and password) for certain protocols, which is prepended to the domain (CVE Mitre).

The vulnerability stems from Squid's URL processing mechanism where decoded UserInfo is prepended to the domain when creating cache keys. An attacker can exploit this by providing a username containing special characters to delimit the domain, treating the rest of the URL as a path or query string. The vulnerability has been assigned a CVSS v3.1 score of 7.5 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating high confidentiality impact with network attack vector and low attack complexity (NetApp Security).

When successfully exploited, this vulnerability allows an attacker to perform cache-injection attacks. On Squid servers that also act as reverse proxies, attackers can gain access to features that only reverse proxies can use, such as ESI (Edge Side Includes). The attacker could serve their HTML content instead of the real HTML when a request for the target domain matches the crafted URL (Ubuntu Security).

The vulnerability can be exploited by making an initial request to the attacker's domain using an encoded username, followed by a request for the target domain that decodes to the exact URL. This allows the attacker to serve their content instead of the legitimate content from the cache (USN Ubuntu).

The vulnerability has been fixed in multiple versions across different distributions. Ubuntu 18.04 users should upgrade to squid version 3.5.27-1ubuntu1.7, while Debian 9 (stretch) users should upgrade to version 3.5.23-5+deb9u2. For Cloud Manager installations upgrading to version 3.9.10, users should run the command 'yum remove squid -y' at the system command line to uninstall Squid (Debian Security, NetApp Security).