SERVER-WEBAPP -- Snort has detected traffic exploiting vulnerabilities in web based applications on servers.
SERVER-WEBAPP Squid host header cache poisoning attempt
This event is generated when a request has been made to Squid proxy which returns cache content from somewhere other than hostname specified in absolute URI from request line Impact: Results in future requests made to poisoned hostname to return content not originating from hostname Details: Ease of Attack: Simple
No public information
No known false positives
Cisco Talos Intelligence Group
Tactic:
Technique:
For reference, see the MITRE ATT&CK vulnerability types here: https://attack.mitre.org
CVE-2016-4553client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when absolute-URI is provided, which allows remote attackers to conduct cache-poisoning attacks via an HTTP request. |
|
|||||||||||||||||||||||||
©2022 Cisco and/or its affiliates. Snort, the Snort and Pig logo are registered trademarks of Cisco. All rights reserved.
