jpillora chisel up to 1.9.x Environment Variable AUTH inconsistency between implementation and documented design

Summaryinfo

A vulnerability labeled as problematic has been found in jpillora chisel up to 1.9.x. Affected by this vulnerability is an unknown functionality of the component Environment Variable Handler. The manipulation of the argument AUTH results in inconsistency between implementation and documented design. This vulnerability is known as CVE-2024-43798. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as problematic, was found in jpillora chisel up to 1.9.x. Affected is an unknown part of the component Environment Variable Handler. The manipulation of the argument AUTH with an unknown input leads to a inconsistency between implementation and documented design vulnerability. CWE is classifying the issue as CWE-1068. The implementation of the product is not consistent with the design as described within the relevant documentation. This is going to have an impact on confidentiality. CVE summarizes:

Chisel is a fast TCP/UDP tunnel, transported over HTTP, secured via SSH. The Chisel server doesn't ever read the documented `AUTH` environment variable used to set credentials, which allows any unauthenticated user to connect, even if credentials were set. Anyone running the Chisel server that is using the `AUTH` environment variable to specify credentials to authenticate against is affected by this vulnerability. Chisel is often used to provide an entrypoint to a private network, which means services that are gated by Chisel may be affected. Additionally, Chisel is often used for exposing services to the internet. An attacker could MITM requests by connecting to a Chisel server and requesting to forward traffic from a remote port. This issue has been addressed in release version 1.10.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2024-43798 since 08/16/2024. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available.

Upgrading to version 1.10.0 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• jpillora

Name

• chisel

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9

Website

• Product: https://github.com/jpillora/chisel/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion