CVE-2021-46784: Squid-cache Squid DoS Vulnerability

CVE-2021-46784 Overview

CVE-2021-46784 is a Denial of Service vulnerability affecting Squid caching proxy server versions 3.x through 3.5.28, 4.x through 4.17, and 5.x before 5.6. The vulnerability stems from improper buffer management when processing long Gopher server responses, which can cause the Squid proxy service to crash or become unresponsive.

Critical Impact

Authenticated attackers can exploit improper buffer management in Squid's Gopher protocol handler to cause service disruption, potentially affecting all users relying on the proxy for internet access.

Affected Products

• Squid-cache Squid versions 3.x through 3.5.28
• Squid-cache Squid versions 4.x through 4.17
• Squid-cache Squid versions 5.x before 5.6
• Debian Linux 10.0, 11.0, and 12.0

Discovery Timeline

• 2022-07-17 - CVE-2021-46784 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-46784

Vulnerability Analysis

This vulnerability is classified under CWE-617 (Reachable Assertion), indicating that the application contains an assertion that can be triggered by a remote attacker. When Squid processes responses from Gopher servers, the buffer management logic fails to properly handle excessively long responses. This improper handling leads to an assertion failure that terminates the Squid process.

The vulnerability requires low privileges to exploit, meaning an authenticated user with access to the proxy can trigger the condition. However, no user interaction is required beyond initiating the malicious request. The impact is limited to availability—there is no confidentiality or integrity impact, but a successful exploit can completely disrupt proxy services.

Root Cause

The root cause lies in Squid's buffer management code for handling Gopher protocol responses. When a Gopher server returns an unusually long response, the buffer handling logic encounters an unexpected state that triggers an assertion failure. The Gopher protocol, while largely deprecated, remains supported in older Squid versions for backward compatibility. The assertion was intended as a debugging safeguard but became reachable in production through crafted Gopher responses.

Attack Vector

The attack is network-based and can be executed by any authenticated user with access to the Squid proxy. An attacker needs to either control a malicious Gopher server or be able to redirect Squid to connect to such a server. When the proxy processes the oversized response, the buffer management assertion triggers, causing the Squid daemon to crash.

The attack flow involves:

1. Attacker configures a Gopher server to return excessively long responses
2. Attacker sends a request through the vulnerable Squid proxy to the malicious Gopher server
3. Squid attempts to process the long response and fails due to improper buffer handling
4. The assertion failure causes the Squid process to terminate, denying service to all proxy users

Detection Methods for CVE-2021-46784

Indicators of Compromise

• Unexpected Squid process crashes or restarts in system logs
• Assertion failure messages in Squid error logs referencing buffer management
• Unusual Gopher protocol traffic patterns (port 70) through the proxy
• Multiple proxy service interruptions without clear infrastructure cause

Detection Strategies

• Monitor Squid access logs for Gopher protocol requests (gopher:// URLs)
• Configure alerting for Squid daemon crashes or unexpected restarts
• Implement network monitoring for outbound connections to port 70 (Gopher)
• Review system logs for assertion failure core dumps from the Squid process

Monitoring Recommendations

• Enable verbose logging for Squid proxy to capture protocol-specific errors
• Set up process monitoring to detect and alert on Squid service availability
• Implement baseline analysis for Gopher traffic volume to detect anomalies
• Configure automatic service restart with crash notification for rapid incident response

How to Mitigate CVE-2021-46784

Immediate Actions Required

• Upgrade Squid to version 5.6 or later, which contains the fix for this vulnerability
• For Squid 4.x installations, apply the SQUID-2021_7 patch for version 4
• For Squid 5.x installations prior to 5.6, apply the SQUID-2021_7 patch for version 5
• Review the GitHub Security Advisory GHSA-f5cp-6rh3-284w for complete remediation guidance

Patch Information

Squid-cache has released patches addressing this vulnerability. The fix is available in Squid version 5.6 and has been backported to older supported versions. The specific commit addressing this issue resolves the buffer management problem in the Gopher response handler. Debian users should consult the Debian CVE Tracker for distribution-specific package updates. NetApp customers should review the NetApp Security Advisory for affected product guidance.

Workarounds

• Disable Gopher protocol support in Squid configuration if not required
• Block outbound connections to port 70 at the network firewall level
• Implement access controls to restrict which users can request Gopher URLs
• Configure Squid to deny requests matching gopher:// URI patterns

# Squid configuration to block Gopher protocol requests
# Add to squid.conf to mitigate CVE-2021-46784

# Create ACL to match Gopher protocol
acl gopher_protocol proto GOPHER

# Deny all Gopher protocol requests
http_access deny gopher_protocol

# Alternatively, block at URL pattern level
acl gopher_urls urlpath_regex ^gopher://
http_access deny gopher_urls