Squid Proxy HTTP Authentication Credentials Disclosure
CVE-2025-62168 is an information disclosure vulnerability in Squid, the web caching proxy, affecting versions prior to 7.2. During error handling, Squid fails to properly redact sensitive HTTP authentication material before embedding request debugging details into generated error content, including administrator mailto links controlled by the email_err_data feature. As a result, error pages may expose the HTTP Authorization header and associated credentials such as usernames, passwords, bearer tokens, or other security tokens. The issue affects both forward and reverse proxy deployments and can occur even when Squid itself is not configured to perform HTTP authentication, because proxied requests may still carry authentication data destined for upstream or backend services.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository provides a Proof-of-Concept (PoC) exploit for CVE-2025-62168, an information disclosure vulnerability in Squid Proxy (versions < 7.2). The vulnerability allows an attacker to inject a custom HTTP header containing a sensitive token (such as a JWT) into a proxied request. When Squid generates an error page (e.g., by requesting a non-existent domain), it may reflect the injected header value inside the mailto diagnostic block of the error page, exposing the token to the attacker. The main exploit script, 'cve-2025-62168.py', is a Python 3 async tool that: - Connects to a user-specified Squid proxy (via --proxy argument) - Sends a request with a custom header (X-Test-Leak) containing a demo JWT token - Forces Squid to generate an error page by requesting a non-existent domain - Parses the returned HTML for the mailto block - Extracts and decodes the leaked token Supporting files include 'payload.json' (JWT payload), 'token.txt' (Bash script to generate the JWT), and 'requirements.txt' (Python dependencies). The README.md provides detailed technical background, usage instructions, and mitigation advice. The exploit demonstrates a network-based attack vector and is a clear, functional PoC for the described vulnerability.
Affected products & vendors
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
Recent activity
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An HTTP authentication credentials disclosure vulnerability in Squid Proxy where the Authorization header can be leaked in an error page mailto block, exposing credentials such as bearer tokens. The content shows Squid 7.1 as vulnerable and Squid 7.2 as patched.
An information disclosure vulnerability in Squid (pre-7.2) where error handling fails to redact HTTP authentication credentials, enabling credential/token leakage and potential bypass of browser security protections.
An information disclosure vulnerability in Squid Proxy caused by failure to redact HTTP authentication credentials from generated error pages, allowing remote attackers to extract usernames, passwords, or bearer tokens from error messages.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.