# Basic Authentication Heap Overflow

Squid's HttpHeader::getAuth base64-decodes the Authorization header into a fixed 8192-byte static buffer without bounds checking, allowing heap overflow via oversized Basic auth blob.

- Payout: hidden
- Severity: high
- Program: Internet Bug Bounty
- Found by: jeriko_one
- Disclosed: 2021-08-26
- CVE: CVE-2019-12527
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/641240
- Library page: https://bugbountylibrary.com/r/h1%3A641240
- Tags: area:cloud domain:infra impact:dos kind:bounty platform:hackerone sev:high tech:curl technique:source-review vuln:dos vuln:memory-corruption

**Target:** Squid proxy HTTP header parser (HttpHeader::getAuth)
**Root cause:** base64_decode_update writes decoded output into a fixed static char[8192] buffer without verifying decodedLen fits, then writes a NUL at decodedAuthToken[decodedLen], overflowing the heap.
**Steps:**
1. Send `GET ftp://<squid_name>:<squid_port>/squid-internal-mgr/menu HTTP/1.1` with an `Authorization: Basic <very long base64 blob>` header (decoded length > 8192, e.g. 43011 bytes).
2. Manager regex does not restrict FTP protocol, so the request reaches HttpHeader::getAuth even without basic auth configured.
3. getAuth calls base64_decode_update into static decodedAuthToken[8192]; decodedLen exceeds buffer, causing heap overflow and out-of-bounds NUL write.
**How found:** Code review of HttpHeader::getAuth revealed the static 8192-byte decodedAuthToken buffer and unchecked base64_decode_update output; gdb confirmed decodedLen=43011 exceeding the buffer. Noted the Manager regex lacks FTP protocol check, making the path reachable by any user.
**Exploitation:** Attacker sends an oversized Basic Authorization header to the cache manager endpoint over FTP scheme; the decoded blob overflows the static heap buffer. No further action reachable from cache manager, so impact limited to memory corruption at the decode site.
**Insight:** Static fixed-size decode buffers paired with attacker-controlled base64 are a classic overflow; also check that internal manager/admin regexes validate the URL scheme, since an FTP-scheme request can still reach HTTP header parsing code paths.