CVE-2019-12524: 
Squid vulnerability analysis and mitigation

A vulnerability was discovered in Squid through version 4.7, identified as CVE-2019-12524. The issue relates to how Squid handles URL decoding when processing requests from users. By default, Squid implements rules via url_regex to block access to the Cache Manager, which contains detailed server information intended for maintainers. The vulnerability was disclosed in June 2019 (MITRE).

The vulnerability stems from the handler for url_regex rules performing URL decoding on incoming requests. This implementation flaw allows attackers to encode their URLs in a way that bypasses the url_regex check. The vulnerability has been assigned a CVSS 3.1 base score of 9.8 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (Ubuntu).

When successfully exploited, this vulnerability allows attackers to bypass the default security rules and gain unauthorized access to the Cache Manager. This could lead to the disclosure of sensitive server information meant only for system maintainers (USN).

The vulnerability is remotely exploitable and requires no special privileges or user interaction. An attacker can bypass certain rule checks by manipulating URL encoding in their requests (NetApp).

The vulnerability has been fixed in multiple distributions: Ubuntu 18.04 with squid version 3.5.27-1ubuntu1.7, Debian 9 (stretch) with version 3.5.23-5+deb9u2, and other affected systems through their respective package updates. Users are recommended to update their Squid installations to the patched versions (Debian).