CVE-2025-62168
CRITICAL NUCLEISquid < 7.2 - Information Disclosure via HTTP Authentication Credential Leak in Error Handling
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2025-62168. PoCs published by monzaviman, adminlove520, shahroodcert. A Nuclei detection template is also available.
AI-analyzed exploit summary The repository contains a scanner for detecting CVE-2025-62168, an information disclosure vulnerability in Squid Proxy. It checks for the presence of HTTP Authentication credentials in error responses and determines if the target Squid Proxy version is vulnerable.
Description
Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure. The vulnerability allows a script to bypass browser security protections and learn the credentials a trusted client uses to authenticate. This potentially allows a remote client to identify security tokens or credentials used internally by a web application using Squid for backend load balancing. These attacks do not require Squid to be configured with HTTP authentication. The vulnerability is fixed in version 7.2. As a workaround, disable debug information in administrator mailto links generated by Squid by configuring squid.conf with email_err_data off.
Exploits (4)
The repository contains a scanner for detecting CVE-2025-62168, an information disclosure vulnerability in Squid Proxy. It checks for the presence of HTTP Authentication credentials in error responses and determines if the target Squid Proxy version is vulnerable.
The repository contains a Python script that scans for CVE-2025-62168, an information disclosure vulnerability in Squid Proxy due to improper redaction of HTTP Authentication credentials. The script checks the Squid version and attempts to detect the vulnerability by analyzing the error page response.
The repository contains a scanner for detecting CVE-2025-62168, an information disclosure vulnerability in Squid Proxy. It checks for the presence of HTTP Authentication credentials in error responses and verifies if the Squid version is vulnerable.
This repository contains a functional PoC for CVE-2025-62168, an information disclosure vulnerability in Squid Proxy where sensitive HTTP headers (e.g., JWT tokens) are reflected in error pages via the mailto diagnostic block. The PoC demonstrates token leakage by forcing a Squid error and parsing the response.
Nuclei Templates (1)
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N