# Cache Poisoning

Squid decodes userinfo in URLs before hashing cache keys, letting attacker-controlled FTP/HTTPS responses be served for unrelated domains.

- Payout: hidden
- Severity: high
- Program: Internet Bug Bounty
- Found by: jeriko_one
- Disclosed: 2021-08-26
- CVE: CVE-2019-12520, CVE-2019-12524
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/824753
- Library page: https://bugbountylibrary.com/r/h1%3A824753
- Tags: area:cloud domain:infra impact:ato impact:integrity kind:bounty platform:hackerone sev:high tech:nginx technique:parser-differential technique:source-review vuln:cache-deception vuln:cache-poisoning

**Target:** Squid HTTP proxy cache (FTP and HTTPS gatewaying)
**Root cause:** Uri::parse rfc1738_unescapes the userinfo portion of the URL, and the decoded userinfo is included in the absolute URL used to compute the cache key MD5, so distinct URLs collide.
**Steps:**
1. Start Squid 4.9 with an FTP server on 192.168.122.1:8080.
2. Send `GET ftp://hackerone.com%2f%3f@192.168.122.1:8080/payload HTTP/1.1` to Squid:3128 to poison the cache.
3. Send `GET ftp://hackerone.com/?@192.168.122.1:8080/payload HTTP/1.1`; observe `X-Cache: HIT` returning attacker FTP content.
4. For HTTPS on Squid 4.7, enable ssl-bump with generated certs and `sslproxy_cert_error allow all`.
5. Serve attacker page with `Cache-Control: public, immutable, max-age=31536000`.
6. Poison via `GET https://hackerone.com%2f%3f@192.168.122.1:8080/html/alert.html`, then request `GET https://hackerone.com/?@192.168.122.1:8080/html/alert.html` to get `X-Cache: HIT` with attacker JS.
**How found:** Noticed Squid's cache key uses url.rawContent() after Uri::parse rfc1738_unescapes userinfo, so encoded `%2f%3f` in userinfo decodes to `/?` producing key collisions across domains; built on prior ACL bypass finding.
**Exploitation:** Attacker hosts a server returning malicious content with cacheable headers, sends a crafted URL whose decoded userinfo collides with a victim domain's cache key, poisoning the shared proxy cache; subsequent victim requests to the trusted domain receive attacker content.
**Escalation:** HTTPS variant yields script execution in the victim domain's origin; FTP variant delivers attacker files disguised as legitimate downloads.
**Insight:** When auditing caches/proxies, check whether the cache key is computed from a normalized/decoded URL rather than the raw request; encoded delimiters in userinfo can collapse distinct origins into one key.