Session Token Leakage via Proxy Response (Squidbleed Vulnerability)

Ankit Mehta@Secvyn

•updated Jun 24, 2026•0•0•1

This rule detects potential session token leakage through network proxy responses. It specifically looks for network events where the action type is 'NetworkSignatureInspected', the remote port is 21 (commonly FTP), and the remote URL contains keywords indicative of session tokens such as 'session', 'cookie', 'JSESSIONID', 'PHPSESSID', or 'ASP.NET_SessionId'. This could indicate a vulnerability where session information is inadvertently exposed in proxy logs or network traffic.