# URN Request bypass ACL Checks

Squid transforms URN requests into internal HTTP requests that skip ACL checks, letting attackers reach localhost-only servers and CacheManager.

- Payout: hidden
- Severity: critical
- Program: Internet Bug Bounty
- Found by: jeriko_one
- Disclosed: 2021-08-26
- CVE: CVE-2019-12523
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/824802
- Library page: https://bugbountylibrary.com/r/h1%3A824802
- Tags: area:cloud domain:infra impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:critical tech:nginx technique:source-review vuln:access-control vuln:auth-bypass vuln:ssrf

**Target:** Squid proxy URN handler / ACL engine
**Root cause:** AnyP::Uri::parse only sets scheme and path for urn: URIs; UrnState::setUriResFromRequest then builds a new HTTP request and calls FwdState::Start directly, bypassing doCallouts/clientAccessChecks ACL enforcement.
**Steps:**
1. Configure `acl Safe_ports port 0` and `http_access deny to_localhost`.
2. Start a localhost HTTP server: `python -m http.server --bind 127.0.0.1 8080`.
3. Send `GET urn::@127.0.0.1:8080/hello.html? HTTP/1.1` to Squid on port 3128.
4. Observe 302 with Location leaking localhost response content (lines containing `:`).
5. If Via header disabled, request `GET urn::@localhost:3128/squid-internal-mgr/active_requests?` to reach CacheManager.
**How found:** Code reading of AnyP::Uri::parse revealed URN handling only sets scheme/path; tracing UrnState::setUriResFromRequest showed the synthesized HTTP request goes straight to FwdState::Start, skipping doCallouts and clientAccessChecks.
**Exploitation:** Attacker sends a crafted URN request to the proxy; Squid rewrites it to `http://<host>/uri-res/N2L?urn:...` and dispatches it via FwdState::Start without ACL checks, reaching localhost-bound services. Response is reflected via the 302 Location header, limited to lines containing ':' and bodies under 4096 bytes.
**Escalation:** Chaining to CacheManager (squid-internal-mgr) when Via header is disabled, exposing internal management endpoints.
**Insight:** Protocol handlers that synthesize a new internal request (URN->HTTP, redirects, internal fetches) often skip the ACL pipeline applied to client requests; audit any code path calling FwdState::Start or equivalent directly rather than through the normal access-check callouts.