tg123 sshpiper up to 1.2.x Proxy Protocol Listener data authenticity

Summaryinfo

A vulnerability has been found in tg123 sshpiper up to 1.2.x and classified as problematic. Impacted is an unknown function of the component Proxy Protocol Listener. This manipulation causes data authenticity. The identification of this vulnerability is CVE-2024-35175. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in tg123 sshpiper up to 1.2.x and classified as problematic. Affected by this vulnerability is an unknown part of the component Proxy Protocol Listener. The manipulation with an unknown input leads to a data authenticity vulnerability. The CWE definition for the vulnerability is CWE-345. The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data. As an impact it is known to affect integrity. The summary by CVE is:

sshpiper is a reverse proxy for sshd. Starting in version 1.0.50 and prior to version 1.3.0, the way the proxy protocol listener is implemented in sshpiper can allow an attacker to forge their connecting address. Commit 2ddd69876a1e1119059debc59fe869cb4e754430 added the proxy protocol listener as the only listener in sshpiper, with no option to toggle this functionality off. This means that any connection that sshpiper is directly (or in some cases indirectly) exposed to can use proxy protocol to forge its source address. Any users of sshpiper who need logs from it for whitelisting/rate limiting/security investigations could have them become much less useful if an attacker is sending a spoofed source address. Version 1.3.0 contains a patch for the issue.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2024-35175 since 05/10/2024. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 1.3.0 eliminates this vulnerability. Applying the patch 2ddd69876a1e1119059debc59fe869cb4e754430 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• tg123

Name

• sshpiper

Version

• 1.0
• 1.1
• 1.2

License

• open-source

Website

• Product: https://github.com/tg123/sshpiper/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion