Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login
    Introducing Netgate Nexus: Multi-Instance Management at Your Fingertips.

    Squid FTP issue

    Scheduled Pinned Locked Moved Cache/Proxy
    vulnerabilityworkaroundsquid
    1 Posts 1 Posters 113 Views 1 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • JonathanLeeJ Offline
      JonathanLee
      last edited by

      Problem: Fixed in version: | Squid 7.7

      Due to a Improper Validation of Syntactic Correctness
      bug Squid is vulnerable to a Command Injection
      attack against FTP Gateway.

      Severity:

      This problem allows a trusted client to perform Command
      Injection when accessing an ftp:// URL. Allowing the client
      access to files, directories and features of the FTP server
      normally forbidden by Squid security policy.

      Workaround:

      Forbid access to FTP Gateway by placing the below settings
      before any "http_access allow" lines in squid.conf:

      acl FTP proto FTP
      http_access deny FTP

      Also, remove from squid.conf the line:
      acl Safe_ports port 21

      acl FTP proto FTP
http_access deny FTP
acl BlockPort21 port 21
http_access deny BlockPort21

      Reference: [squid-announce] [ADVISORY] SQUID-2026:9 FTP command injection in FTP gateway from "squid-announce@lists.squid-cache.org" squid-announce@lists.squid-cache.org

      Make sure to upvote

      1 Reply Last reply Reply Quote 0
      • First post
        Last post
      Copyright 2026 Rubicon Communications LLC (Netgate). All rights reserved.
      Privacy Policy · Cookie Policy