Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The "%xx" URL decoding function in Squid 2.5STABLE4 and earlier allows remote attackers to bypass url_regex ACLs via a URL with a NULL ("%00") character, which causes Squid to use only a portion of the requested URL when comparing it against the access control lists.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Squid Proxy NULL URL字符未授权访问漏洞
Vulnerability Description
Squid（全称Squid Cache）是一套代理服务器和Web缓存服务器软件。该软件提供缓存万维网、过滤流量、代理上网等功能。 Squid代理在处理NULL URL字符时存在问题，远程攻击者可以利用这个漏洞绕过访问控制，未授权访问资源。 Squid存在一个解码问题允许用户绕过使用'url_regex' ACL类型的访问控制。如果"%00"出现在URL中，以前的squid版本解码时会插入NUL字符，如考虑下面的访问控制配置： acl BadSite url_regex www\.example\.com
CVSS Information
N/A
Vulnerability Type
N/A