information about vulnerabilities in the proxy server , which were quietly addressed last year in Squid 4.8. Issues are present in the code that handles the '@' block at the beginning of the URL ('user@host') and allow bypassing access control rules, sending cache content, and performing cross-site scripting attacks.
- — a client can bypass rules set by the url_regex directive using a specially crafted URL, gaining access to sensitive information about the proxy and the processed traffic (accessing the Cache Manager interface).
- — by manipulating username data in the URL, one can cause false content to be cached for a specific page, which can be used to execute one's own JavaScript code in the context of other sites.
Source: opennet.ru
