CVE-2021-31807: Squid-cache Squid DOS Vulnerability

CVE-2021-31807 Overview

An integer overflow vulnerability was discovered in Squid, the popular open-source caching proxy server. This flaw exists in versions prior to 4.15 and 5.x versions before 5.0.6, allowing a remote server to cause a Denial of Service (DoS) condition when delivering responses to HTTP Range requests. The vulnerability is particularly concerning because the trigger is a header that can legitimately exist in normal HTTP traffic without any malicious intent, making it difficult to distinguish attacks from regular operations.

Critical Impact

Remote attackers can exploit this integer overflow to crash Squid proxy servers, disrupting network operations and potentially affecting all clients dependent on the proxy for internet access.

Affected Products

• Squid-cache Squid (versions prior to 4.15 and 5.x before 5.0.6)
• Fedora Project Fedora (versions 33 and 34)
• NetApp Cloud Manager

Discovery Timeline

• June 8, 2021 - CVE-2021-31807 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2021-31807

Vulnerability Analysis

This vulnerability stems from an integer overflow condition (CWE-190) in Squid's handling of HTTP Range request responses. HTTP Range requests allow clients to request specific byte ranges from a resource, which is commonly used for resumable downloads, video streaming, and partial content delivery. When Squid processes responses containing Range headers from upstream servers, an integer overflow can occur during the calculation of byte ranges, leading to unexpected behavior and service disruption.

The issue is exploitable over the network and requires low privileges to trigger. An attacker operating a malicious web server can craft HTTP responses with specially constructed Range headers that trigger the integer overflow when processed by a vulnerable Squid proxy. Since Range headers are a standard part of HTTP/1.1 and commonly appear in legitimate traffic, filtering malicious requests presents a significant challenge.

Root Cause

The root cause is an integer overflow vulnerability (CWE-190) in Squid's response parsing logic for HTTP Range requests. When calculating byte range boundaries from server responses, the code fails to properly validate that the arithmetic operations will not overflow integer boundaries. This can result in unexpected values being used for memory allocations or buffer operations, ultimately causing the proxy to crash or become unresponsive.

Attack Vector

The attack is conducted over the network where a remote malicious server delivers crafted HTTP responses to Range requests initiated through the Squid proxy. The attack flow proceeds as follows:

1. A client behind the Squid proxy initiates a request that results in a Range request to a malicious server
2. The malicious server responds with a specially crafted Content-Range header containing values designed to trigger integer overflow
3. Squid processes the response and performs arithmetic operations on the range values
4. The integer overflow causes incorrect calculations, leading to denial of service

Since HTTP Range headers are legitimate components of HTTP traffic, the malicious payload can appear benign during standard traffic inspection. The vulnerability can be triggered without any authentication, making it accessible to any server that can be contacted through the vulnerable proxy.

Detection Methods for CVE-2021-31807

Indicators of Compromise

• Unexpected Squid proxy crashes or service restarts, particularly when processing content from specific external servers
• Log entries indicating abnormal Range header processing or memory-related errors in Squid logs
• Increased frequency of HTTP 503 or 502 errors returned to proxy clients
• Crash dumps or core files generated by Squid processes showing failures in range parsing functions

Detection Strategies

• Monitor Squid proxy stability and implement alerting for unexpected process terminations or restarts
• Analyze HTTP response headers from upstream servers for unusually large or malformed Content-Range values
• Deploy network intrusion detection signatures to identify HTTP responses with suspicious Range header patterns
• Review Squid access and cache logs for anomalous patterns involving partial content responses

Monitoring Recommendations

• Implement health checks for Squid proxy services with automatic alerting on availability changes
• Configure centralized logging for Squid instances to enable correlation of crash events with specific upstream servers
• Monitor system resources on Squid hosts for signs of resource exhaustion or abnormal memory usage patterns
• Establish baseline metrics for proxy restarts and alert on deviations from normal operational patterns

How to Mitigate CVE-2021-31807

Immediate Actions Required

• Upgrade Squid to version 4.15 or later for the 4.x branch, or version 5.0.6 or later for the 5.x branch
• Review upstream server configurations and consider blocking connections to untrusted external servers where possible
• Implement proxy availability monitoring to quickly detect and respond to DoS conditions
• Consider deploying redundant proxy infrastructure to maintain service availability during potential attacks

Patch Information

Security patches are available from the Squid project. The official patch for version 4.x is available through the Squid Cache Patch repository. Additional security information can be found in the GitHub Security Advisory. Fedora users should apply updates announced through the Fedora Package Announcement. Debian LTS users should consult the Debian LTS Announcement. NetApp customers should review the NetApp Security Advisory for Cloud Manager guidance.

Workarounds

• If immediate patching is not possible, consider implementing upstream server whitelisting to reduce exposure to malicious servers
• Deploy a web application firewall or reverse proxy in front of Squid to inspect and filter potentially malicious Range headers
• Configure rate limiting on proxy connections to reduce the impact of exploitation attempts
• Implement automated proxy restart mechanisms to minimize downtime in case of crashes

# Verify Squid version to determine vulnerability status
squid -v | grep "Squid Cache"

# Check current Squid service status
systemctl status squid

# Apply updates on Debian/Ubuntu systems
apt-get update && apt-get install --only-upgrade squid

# Apply updates on RHEL/CentOS/Fedora systems
dnf update squid