Squid as reverse proxy RCE and data leak
该报告还没有中文解读。
原文摘录
摘自原文(3381 字符中的一小部分)
Summary: This was a very difficult experience as Squid maintainers took a long time to answer. I tried getting help from HackerOne support, Dropbox support and the Internet Bug Bounty (never e-mailed me back) to no avail. What could have taken a few days took months.
原文中的代码
mkdir squid-poc cd squid-poc/ wget 'https://github.com/squid-cache/squid/archive/SQUID_4_8.tar.gz' tar zxf SQUID_4_8.tar.gz mkdir squid-install cd squid-SQUID_4_8/ autoreconf -if ./configure --prefix=$(realpath ../squid-install) make -j$(nproc) make install cd ../squid-install/sbin/
默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 Internet Bug Bounty 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @guido · 版权归作者与 Internet Bug Bounty 所有