CVE-2023-46846: Squid-cache HTTP Smuggling Vulnerability

CVE-2023-46846 Overview

CVE-2023-46846 is an HTTP Request Smuggling vulnerability affecting the Squid caching proxy server. The flaw exists in Squid's chunked transfer encoding decoder, which exhibits lenient parsing behavior that can be exploited by remote attackers. This vulnerability allows malicious actors to smuggle HTTP requests and responses past firewall and frontend security systems, potentially bypassing security controls and accessing protected resources.

HTTP Request Smuggling attacks exploit inconsistencies in how different HTTP processors (such as proxies, load balancers, and backend servers) parse HTTP requests. In this case, Squid's lenient handling of chunked encoding allows attackers to craft specially malformed requests that are interpreted differently by Squid and downstream servers, enabling request/response smuggling.

Critical Impact

Remote attackers can bypass firewall and frontend security systems through HTTP request smuggling, potentially accessing protected resources, poisoning caches, or hijacking user sessions.

Affected Products

• Squid-cache Squid (multiple versions)
• Red Hat Enterprise Linux 8.0
• Red Hat Enterprise Linux 9.0
• Red Hat Enterprise Linux EUS 8.6, 8.8, 9.0, 9.2
• Red Hat Enterprise Linux for ARM 64
• Red Hat Enterprise Linux for IBM z Systems
• Red Hat Enterprise Linux for Power, little endian
• Red Hat Enterprise Linux Server AUS 8.2, 8.4, 8.6, 9.2
• Red Hat Enterprise Linux Server TUS 8.2, 8.4, 8.6, 8.8, 9.2

Discovery Timeline

• November 3, 2023 - CVE-2023-46846 published to NVD
• December 18, 2024 - Last updated in NVD database

Technical Details for CVE-2023-46846

Vulnerability Analysis

The vulnerability resides in Squid's chunked transfer encoding decoder, which is responsible for parsing HTTP requests that use chunked encoding as specified in RFC 7230. The decoder exhibits lenient parsing behavior, accepting malformed chunked encoding that deviates from the HTTP specification. This lenience creates a parsing discrepancy between Squid and backend servers or security devices in the request chain.

When Squid processes an HTTP request with malformed chunked encoding, it may interpret the request boundaries differently than downstream servers. This discrepancy allows an attacker to craft a single HTTP request that Squid sees as one request, while a backend server interprets it as two separate requests. The "smuggled" second request can bypass Squid's access controls and reach the backend server directly.

The vulnerability is classified under CWE-444 (Inconsistent Interpretation of HTTP Requests), which specifically addresses HTTP Request Smuggling issues arising from different interpretations of the HTTP protocol between system components.

Root Cause

The root cause of this vulnerability is Squid's overly permissive parsing of chunked transfer encoding. The chunked decoder fails to strictly validate the format of chunk size lines and chunk data boundaries according to RFC specifications. This lenient parsing behavior accepts variations in chunk formatting that should be rejected as malformed, creating an interpretation gap that attackers can exploit.

Specifically, the decoder may accept:

• Improper chunk size delimiters
• Invalid characters in chunk size lines
• Inconsistent newline handling between chunk boundaries

These parsing inconsistencies allow attackers to construct HTTP requests where the perceived request boundaries differ between Squid and other HTTP processors in the request chain.

Attack Vector

An attacker exploits this vulnerability by sending specially crafted HTTP requests to a Squid proxy server. The attack is network-based and requires no authentication or user interaction. The attacker constructs an HTTP request with malformed chunked encoding that exploits the parsing differences between Squid and backend systems.

The attack flow typically involves:

1. The attacker sends a crafted HTTP request with malformed chunked encoding to the Squid proxy
2. Squid's lenient parser processes the request, interpreting chunk boundaries in a specific way
3. The request is forwarded to a backend server or passes through other security systems
4. The backend system parses the same request differently, extracting a "hidden" second request
5. The smuggled request bypasses Squid's access controls and security policies

This technique can be used to bypass security controls, poison web caches, hijack user sessions, or access restricted resources on backend servers. The network attack vector makes this vulnerability particularly dangerous in environments where Squid serves as a security boundary or reverse proxy.

Detection Methods for CVE-2023-46846

Indicators of Compromise

• Unusual HTTP requests with malformed or non-standard chunked transfer encoding in Squid access logs
• Requests containing multiple Transfer-Encoding headers or conflicting Content-Length and Transfer-Encoding headers
• Backend server logs showing requests that don't appear in corresponding Squid proxy logs
• Unexpected cache pollution or cache entries with suspicious content

Detection Strategies

• Implement deep packet inspection (DPI) to detect malformed chunked encoding patterns in HTTP traffic
• Monitor for HTTP requests containing both Content-Length and Transfer-Encoding: chunked headers simultaneously
• Deploy web application firewalls (WAF) with rules to detect HTTP request smuggling attack patterns
• Configure SIEM rules to correlate Squid access logs with backend server logs to identify discrepancies

Monitoring Recommendations

• Enable verbose logging on Squid to capture detailed request parsing information
• Implement log correlation between Squid proxy logs and backend application logs to detect request smuggling attempts
• Monitor for unusual access patterns to restricted resources that should be blocked by Squid ACLs
• Set up alerts for requests containing suspicious Transfer-Encoding header variations

How to Mitigate CVE-2023-46846

Immediate Actions Required

• Update Squid to the latest patched version immediately
• Review and restrict network access to Squid proxy servers where possible
• Implement additional request validation at backend servers to reject malformed HTTP requests
• Consider deploying a WAF with HTTP request smuggling detection capabilities in front of Squid

Patch Information

Security patches addressing this vulnerability have been released by Squid-cache and multiple Linux distributions. Refer to the following resources for vendor-specific patching guidance:

• GitHub Security Advisory GHSA-j83v-w3p4-5cqh - Official Squid security advisory
• Red Hat Security Advisory RHSA-2023:6266 - RHEL 8 patch
• Red Hat Security Advisory RHSA-2023:6801 - RHEL 9 patch
• Red Hat CVE Analysis - Red Hat's detailed CVE analysis

Red Hat has released updated Squid packages across all affected Enterprise Linux versions. NetApp and Debian have also released advisories and patches for affected systems.

Workarounds

• Configure stricter HTTP request parsing at network firewalls to normalize or reject requests with malformed chunked encoding
• If feasible, disable chunked transfer encoding support on Squid until patches can be applied
• Implement application-layer request validation on backend servers to independently verify request integrity
• Use network segmentation to limit the exposure of backend servers to potentially smuggled requests

# Verify current Squid version
squid -v

# Check for available updates (RHEL/CentOS)
yum check-update squid

# Apply the security update
yum update squid

# Restart Squid after patching
systemctl restart squid

# Verify the new version is installed
squid -v