nehkark/cve-2025-62168Proof-of-Concept (PoC) for CVE-2025-62168 👾
The author assumes no liability for misuse or damage caused by this tool. Research is provided strictly for educational and defensive purposes.
This repository contains a Proof-of-Concept (PoC) for CVE-2025-62168 , an information-disclosure flaw affecting Squid Proxy. Under certain configurations, Squid may reflect HTTP request headers inside its auto-generated error pages, specifically within the mailto: diagnostic block.
This behavior can expose sensitive tokens such as:
The PoC demonstrates how a single injected header can appear unredacted inside the error template, allowing an attacker to retrieve the leaked token through a forced network error.
This vulnerability arises from the way Squid generates and returns error pages. When an error occurs, Squid’s response may unintentionally embed sensitive HTTP authentication data inside the administrator mailto link created through the email_err_data directive.
Systems are affected whenever email_err_data is enabled — including default configurations — and exposure can occur even if Squid is not explicitly configured to use HTTP authentication.
The issue is classified under:
This makes the flaw especially critical, as leaked credentials may belong to internal applications, backend services, or authenticated clients relying on Squid as a proxy layer.
When Squid builds an error page (e.g., ERR_READ_ERROR), the internal template may include:
HTTP Request:
Header: VALUE
If sanitization fails, the user-supplied header is inserted into the mailto: hyperlink used for diagnostics. This PoC triggers an error using a non-existent domain and inspects the returned HTML for unredacted data.
The vulnerability enables an attacker to bypass normal browser security controls and extract authentication credentials used by trusted clients. This includes tokens and session data belonging to internal web applications or backend services, especially in environments where Squid operates as a reverse proxy or load balancer. By capturing this information directly from Squid’s generated error pages, an attacker could impersonate legitimate users, escalate access, move laterally within the network, or compromise backend systems that rely on Squid for traffic handling.
mailto: body (URL-encoded)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Score: 7.5 (High)
python3 cve-2025-62168.py --proxy http://127.0.0.1:3128
Technical mode:
python3 cve-2025-62168.py --proxy http://127.0.0.1:3128 --verbose
The script performs:
mailto: diagnostic blockSTEP 4 — Parsing mailto block...
X-Test-Leak: <JWT TOKEN>
STEP 5 — TOKEN LEAK CONFIRMED
<decoded token>
CVE-2025-62168/
│
├── LICENSE
├── README.md
├── cve-2025-62168.py
├── example.txt
├── payload.json
├── requirements.txt
└── token.txt
ERR_*) for leaked metadata