# UrnState Heap Overflow

Squid URN handler copies attacker response into a 4096-byte heap buffer using full buffer length instead of remaining space, overflowing adjacent memory and the urlres pointer.

- Payout: hidden
- Severity: critical
- Program: Internet Bug Bounty
- Found by: jeriko_one
- Disclosed: 2021-08-26
- CVE: CVE-2019-12526
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/824771
- Library page: https://bugbountylibrary.com/r/h1%3A824771
- Tags: area:cloud domain:infra impact:dos impact:rce kind:bounty platform:hackerone sev:critical tech:linux technique:source-review vuln:dos vuln:memory-corruption

**Target:** Squid proxy URN request handler (urn.cc / stmem.cc)
**Root cause:** urnHandleReply sets tempBuffer.length to URN_REQBUF_SZ (total buffer size) rather than the remaining space (URN_REQBUF_SZ - reqofs), so a second storeClientCopy writes past the 4096-byte reqbuf.
**Steps:**
1. Add `acl Safe_ports port 0` to squid.conf to permit URN requests.
2. Build Squid with `-fsanitize=address -g` and `ASAN_OPTIONS=detect_leaks=false abort_on_error=true`.
3. Start Squid: `./sbin/squid --foreground -d 100`.
4. Start a server returning 4096 bytes: `socat TCP-LISTEN:8080,fork SYSTEM:"python -c 'print(\"A\" * 4096)'"`.
5. Send `GET urn::@<attacker IP>:8080/ HTTP/1.1\r\n\r\n` to Squid port 3128 via nc.
6. Observe ASan heap-buffer-overflow WRITE of size 81 in mem_hdr::copyAvailable via store_client::scheduleMemRead.
**How found:** Code review of urnHandleReply: noticed tempBuffer.length was set to the full URN_REQBUF_SZ instead of the remaining space, hypothesizing a second storeClientCopy would overflow; confirmed with ASan and a 4096-byte response server.
**Exploitation:** Attacker controls a URN-resolving server response; Squid buffers it into urnState->reqbuf and on a second copy overflows past the 4096-byte allocation. Overflow can corrupt an adjacent object's vtable pointer for control-flow hijack, or overwrite the urlres pointer inside urnState which is later freed, yielding a UAF. Combined with the previously reported Cache Manager bypass to learn valid addresses, this can lead to RCE.
**Escalation:** Chained with a Cache Manager info-leak/bypass to know valid heap addresses, enabling reliable vtable overwrite or UAF exploitation toward RCE.
**Insight:** When auditing buffered-read loops, check whether the copy length is the total buffer size or the remaining space (size - offset); a second callback invocation is where the off-by-remaining bug manifests. Also note struct-embedded buffers let overflow corrupt a following pointer that is later freed, turning a linear overflow into a UAF primitive.