# Squid as reverse proxy RCE and data leak

Stack buffer overflow in Squid reverse-proxy Host header parsing crashes the server and can leak memory or enable RCE without stack protector.

- Payout: hidden
- Severity: critical
- Program: Internet Bug Bounty
- Found by: guido
- Disclosed: 2021-08-26
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/778610
- Library page: https://bugbountylibrary.com/r/h1%3A778610
- Tags: area:cloud domain:infra impact:data-leak impact:dos impact:rce kind:bounty platform:hackerone sev:critical tech:linux vuln:dos vuln:info-disclosure vuln:memory-corruption

**Target:** Squid reverse proxy HTTP Host header parser
**Root cause:** Host header parsing in reverse-proxy (accel) mode copies into a fixed stack buffer with an overflowing subtraction, allowing a long Host value to overflow the stack.
**Steps:**
1. Build Squid 4.8 from source and install.
2. Configure `http_port 9999 accel defaultsite=127.0.0.1 vhost vport=1` with a cache_peer originserver.
3. Run `./squid -N -f squid.conf`.
4. Send `GET / HTTP/1.1\r\nHost: <long x string>:\r\n\r\n` via nc to localhost:9999.
5. Observe `*** buffer overflow detected ***` and abort/core dump.
**Exploitation:** Attacker sends oversized Host header to reverse-proxy port; without -fstack-protector (e.g. Clang default) the overflow can overwrite return address on 32-bit or a boolean config variable on 64-bit; musl libc (OpenWRT/Alpine) skips the NULL write making exploitation easier. Certain payload lengths instead leak uninitialized stack bytes back in the response.
**Insight:** Reverse-proxy/accel mode parses Host differently than forward-proxy mode; test Host header length limits specifically when Squid runs as an origin accelerator, and check musl-based builds where the NULL-termination write is skipped.