CVE-2024-28002, dubbed "Squidbleed," is a high-severity heap over-read vulnerability located within the FTP parser module of the Squid web proxy. Originating from a code implementation in 1997, the flaw allows an attacker or any user capable of routing traffic through the proxy to read beyond intended memory buffer boundaries. This results in the leakage of sensitive, cleartext data from other concurrent users, specifically HTTP request headers, authentication credentials, and session tokens. Immediate patching or disabling the FTP parser is required to mitigate the risk of unauthorized confidentiality breaches.

• Vulnerability Overview: The 29-Year Legacy

  • Identified as CVE-2024-28002, a critical memory leak discovered and disclosed by researchers at Calif.io.
  • The flaw traces back to an FTP-parsing logic error introduced nearly three decades ago in 1997.
  • The vulnerability remains active in default configurations, creating a massive window of historical exposure.

• Technical Mechanics: Heap Over-read

  • Occurs within the Squid Proxy FTP parser module during the processing of FTP traffic.
  • Triggered by a heap over-read that allows the process to read data residing outside the allocated memory buffer.
  • Exploitable by any user or attacker permitted to send traffic through the affected Squid proxy instance.

• Impact Analysis: Data Confidentiality Breach

  • Primary impact is a total breach of confidentiality via unauthorized memory exposure.
  • Leaks cleartext HTTP requests, including highly sensitive session tokens and user credentials.
  • Enables attackers to hijack active sessions or steal credentials from other users sharing the proxy.

• Remediation and Mitigation Strategies

  • Prioritize updating Squid Proxy to the latest patched version released by the maintainers.
  • Disable the FTP parser module if FTP proxying is not required for operational needs.
  • Review network access controls to limit who can route traffic through the proxy instance.