CVE-2024-35175

2024-05-1422:15:10

CWE-345

[email protected]

web.nvd.nist.gov

ssh reverse proxy

vulnerability

address forging

sshpiper

security patch

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

5.1 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.3%

JSON

sshpiper is a reverse proxy for sshd. Starting in version 1.0.50 and prior to version 1.3.0, the way the proxy protocol listener is implemented in sshpiper can allow an attacker to forge their connecting address. Commit 2ddd69876a1e1119059debc59fe869cb4e754430 added the proxy protocol listener as the only listener in sshpiper, with no option to toggle this functionality off. This means that any connection that sshpiper is directly (or in some cases indirectly) exposed to can use proxy protocol to forge its source address. Any users of sshpiper who need logs from it for whitelisting/rate limiting/security investigations could have them become much less useful if an attacker is sending a spoofed source address. Version 1.3.0 contains a patch for the issue.

Affected configurations

Vulners

Node

tg123sshpiperRange1.0.50–1.3.0

CNA Affected

[
  {
    "vendor": "tg123",
    "product": "sshpiper",
    "versions": [
      {
        "version": ">= 1.0.50, < 1.3.0",
        "status": "affected"
      }
    ]
  }
]