POJIA破甲
地图 / HTTP Smuggling multiple issues in Squid 3.x & squid 4.x

HTTP Smuggling multiple issues in Squid 3.x & squid 4.x

注入与走私 / HTTP Response Splitting / #758445

厂商
Internet Bug Bounty
严重程度
高危 · CVSS 9.6
赏金
—
弱点
HTTP Response Splitting
研究员
@regilero
披露日期
2021-08-26
资产
IBB (Legacy)
CVE
CVE-2019-18678CVE-2020-15811CVE-2020-8449

该报告还没有中文解读。

原文摘录

摘自原文(6278 字符中的一小部分)
Hello, as can be seen on a recent public security update by Squid I reported several smuggling issues. If you want some background on impact of Smuggling issues You can check the current works of James Keetle or my own previous published works.

默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 Internet Bug Bounty 所有。

时间线

  • 报告提交
  • 公开披露
阅读 HackerOne 原文 ↗作者 @regilero · 版权归作者与 Internet Bug Bounty 所有

同类报告

HTTP Response Header Injection in shopify/pitchfork + Rack 3Shopify · 2025-03-27 · $800Http request splittingNode.js · 2020-01-15[m.airbnb.com] CRLF InjectionAirbnb · 2018-04-03 · $2,500[newscdn.starbucks.com] CRLF Injection, XSSStarbucks · 2017-03-09HTTP/2 and HTTP/3 Header Injection in curlcurl · 2025-12-30moderate: Apache HTTP Server: HTTP response splitting (CVE-2023-38709)Internet Bug Bounty · 2024-07-13 · $2,600