# Cache Manager ACL Bypass

Squid cache manager ACL bypass via double URL decoding of userinfo allows unauthenticated access to squid-internal-mgr pages, leaking client info and memory addresses.

- Payout: hidden
- Severity: critical
- Program: Internet Bug Bounty
- Found by: jeriko_one
- Disclosed: 2021-08-26
- CVE: CVE-2019-12524
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/824203
- Library page: https://bugbountylibrary.com/r/h1%3A824203
- Tags: area:cloud domain:infra impact:internal-access kind:bounty platform:hackerone sev:critical tech:nginx technique:parser-differential vuln:access-control vuln:auth-bypass

**Target:** Squid proxy cache manager
**Root cause:** ACLUrlStrategy::match decodes the effectiveRequestUri, but Uri::parse already decoded userinfo, causing double decoding. The manager ACL regex fails to match the decoded URL, while internalCheck still sees the original path.
**Steps:**
1. Start Squid 4.7.
2. Send request: `GET https://jeriko.one%252f@<hostname>:3128/squid-internal-mgr/active_requests HTTP/1.1`
3. Observe 200 OK with cache manager content.
**How found:** Researcher noticed that ACLUrlStrategy::match decodes the URL, and Uri::parse also decodes userinfo, leading to double decoding. Tested with encoded slash in userinfo to bypass manager ACL.
**Exploitation:** Attacker sends crafted URL with double-encoded slash in userinfo. ACL check decodes once, making regex fail, but internal routing uses original path to access cache manager. No authentication required.
**Escalation:** Cache manager leaks memory addresses (ASLR bypass) and client info, aiding further attacks like RCE.
**Insight:** When URL parsing and ACL matching both perform decoding, look for double-decoding discrepancies. Userinfo is often decoded early and can contain encoded delimiters that affect later regex matching.