CVE-2024-43798 (GCVE-0-2024-43798)

Vulnerability from cvelistv5 – Published: 2024-08-26 22:32 – Updated: 2024-08-27 13:06
VLAI?
Summary
Chisel is a fast TCP/UDP tunnel, transported over HTTP, secured via SSH. The Chisel server doesn't ever read the documented `AUTH` environment variable used to set credentials, which allows any unauthenticated user to connect, even if credentials were set. Anyone running the Chisel server that is using the `AUTH` environment variable to specify credentials to authenticate against is affected by this vulnerability. Chisel is often used to provide an entrypoint to a private network, which means services that are gated by Chisel may be affected. Additionally, Chisel is often used for exposing services to the internet. An attacker could MITM requests by connecting to a Chisel server and requesting to forward traffic from a remote port. This issue has been addressed in release version 1.10.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity ?
8.6 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CWE
  • CWE-306 - Missing Authentication for Critical Function
  • CWE-1068 - Inconsistency Between Implementation and Documented Design
Assigner
References
Impacted products
Vendor Product Version
jpillora chisel Affected: < 1.10.0
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:jpillora:chisel:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "chisel",
            "vendor": "jpillora",
            "versions": [
              {
                "lessThan": "1.10.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-43798",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-27T13:03:25.275313Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-27T13:06:11.097Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "chisel",
          "vendor": "jpillora",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.10.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Chisel is a fast TCP/UDP tunnel, transported over HTTP, secured via SSH. The Chisel server doesn\u0027t ever read the documented `AUTH` environment variable used to set credentials, which allows any unauthenticated user to connect, even if credentials were set. Anyone running the Chisel server that is using the `AUTH` environment variable to specify credentials to authenticate against is affected by this vulnerability. Chisel is often used to provide an entrypoint to a private network, which means services that are gated by Chisel may be affected. Additionally, Chisel is often used for exposing services to the internet. An attacker could MITM requests by connecting to a Chisel server and requesting to forward traffic from a remote port. This issue has been addressed in release version 1.10.0. All users are advised to upgrade. There are no known workarounds for this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1068",
              "description": "CWE-1068: Inconsistency Between Implementation and Documented Design",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-26T22:32:43.575Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jpillora/chisel/security/advisories/GHSA-38jh-8h67-m7mj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jpillora/chisel/security/advisories/GHSA-38jh-8h67-m7mj"
        }
      ],
      "source": {
        "advisory": "GHSA-38jh-8h67-m7mj",
        "discovery": "UNKNOWN"
      },
      "title": "Chisel AUTH environment variable not respected in server entrypoint"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-43798",
    "datePublished": "2024-08-26T22:32:43.575Z",
    "dateReserved": "2024-08-16T14:20:37.325Z",
    "dateUpdated": "2024-08-27T13:06:11.097Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Chisel is a fast TCP/UDP tunnel, transported over HTTP, secured via SSH. The Chisel server doesn\u0027t ever read the documented `AUTH` environment variable used to set credentials, which allows any unauthenticated user to connect, even if credentials were set. Anyone running the Chisel server that is using the `AUTH` environment variable to specify credentials to authenticate against is affected by this vulnerability. Chisel is often used to provide an entrypoint to a private network, which means services that are gated by Chisel may be affected. Additionally, Chisel is often used for exposing services to the internet. An attacker could MITM requests by connecting to a Chisel server and requesting to forward traffic from a remote port. This issue has been addressed in release version 1.10.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.\"}, {\"lang\": \"es\", \"value\": \"Chisel es un t\\u00fanel TCP/UDP r\\u00e1pido, transportado a trav\\u00e9s de HTTP y protegido mediante SSH. El servidor Chisel nunca lee la variable de entorno documentada \\\"AUTH\\\" utilizada para establecer las credenciales, lo que permite que cualquier usuario no autenticado se conecte, incluso si se configuraron las credenciales. Cualquiera que ejecute el servidor Chisel y utilice la variable de entorno `AUTH` para especificar las credenciales con las que autenticarse se ver\\u00e1 afectado por esta vulnerabilidad. Chisel se utiliza a menudo para proporcionar un punto de entrada a una red privada, lo que significa que los servicios controlados por Chisel pueden verse afectados. Adem\\u00e1s, Chisel se utiliza a menudo para exponer servicios a Internet. Un atacante podr\\u00eda realizar solicitudes MITM conect\\u00e1ndose a un servidor Chisel y solicitando reenviar tr\\u00e1fico desde un puerto remoto. Este problema se solucion\\u00f3 en la versi\\u00f3n 1.10.0. Se recomienda a todos los usuarios que actualicen. No se conocen workarounds para esta vulnerabilidad.\"}]",
      "id": "CVE-2024-43798",
      "lastModified": "2024-08-27T13:01:37.913",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\", \"baseScore\": 8.6, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 4.0}]}",
      "published": "2024-08-26T23:15:04.160",
      "references": "[{\"url\": \"https://github.com/jpillora/chisel/security/advisories/GHSA-38jh-8h67-m7mj\", \"source\": \"security-advisories@github.com\"}]",
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-306\"}, {\"lang\": \"en\", \"value\": \"CWE-1068\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-43798\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-08-26T23:15:04.160\",\"lastModified\":\"2024-08-27T13:01:37.913\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Chisel is a fast TCP/UDP tunnel, transported over HTTP, secured via SSH. The Chisel server doesn\u0027t ever read the documented `AUTH` environment variable used to set credentials, which allows any unauthenticated user to connect, even if credentials were set. Anyone running the Chisel server that is using the `AUTH` environment variable to specify credentials to authenticate against is affected by this vulnerability. Chisel is often used to provide an entrypoint to a private network, which means services that are gated by Chisel may be affected. Additionally, Chisel is often used for exposing services to the internet. An attacker could MITM requests by connecting to a Chisel server and requesting to forward traffic from a remote port. This issue has been addressed in release version 1.10.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.\"},{\"lang\":\"es\",\"value\":\"Chisel es un t\u00fanel TCP/UDP r\u00e1pido, transportado a trav\u00e9s de HTTP y protegido mediante SSH. El servidor Chisel nunca lee la variable de entorno documentada \\\"AUTH\\\" utilizada para establecer las credenciales, lo que permite que cualquier usuario no autenticado se conecte, incluso si se configuraron las credenciales. Cualquiera que ejecute el servidor Chisel y utilice la variable de entorno `AUTH` para especificar las credenciales con las que autenticarse se ver\u00e1 afectado por esta vulnerabilidad. Chisel se utiliza a menudo para proporcionar un punto de entrada a una red privada, lo que significa que los servicios controlados por Chisel pueden verse afectados. Adem\u00e1s, Chisel se utiliza a menudo para exponer servicios a Internet. Un atacante podr\u00eda realizar solicitudes MITM conect\u00e1ndose a un servidor Chisel y solicitando reenviar tr\u00e1fico desde un puerto remoto. Este problema se solucion\u00f3 en la versi\u00f3n 1.10.0. Se recomienda a todos los usuarios que actualicen. No se conocen workarounds para esta vulnerabilidad.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\",\"baseScore\":8.6,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":4.0}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-306\"},{\"lang\":\"en\",\"value\":\"CWE-1068\"}]}],\"references\":[{\"url\":\"https://github.com/jpillora/chisel/security/advisories/GHSA-38jh-8h67-m7mj\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-43798\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-08-27T13:03:25.275313Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:jpillora:chisel:*:*:*:*:*:*:*:*\"], \"vendor\": \"jpillora\", \"product\": \"chisel\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1.10.0\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-08-27T13:06:05.413Z\"}}], \"cna\": {\"title\": \"Chisel AUTH environment variable not respected in server entrypoint\", \"source\": {\"advisory\": \"GHSA-38jh-8h67-m7mj\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 8.6, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"jpillora\", \"product\": \"chisel\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 1.10.0\"}]}], \"references\": [{\"url\": \"https://github.com/jpillora/chisel/security/advisories/GHSA-38jh-8h67-m7mj\", \"name\": \"https://github.com/jpillora/chisel/security/advisories/GHSA-38jh-8h67-m7mj\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Chisel is a fast TCP/UDP tunnel, transported over HTTP, secured via SSH. The Chisel server doesn\u0027t ever read the documented `AUTH` environment variable used to set credentials, which allows any unauthenticated user to connect, even if credentials were set. Anyone running the Chisel server that is using the `AUTH` environment variable to specify credentials to authenticate against is affected by this vulnerability. Chisel is often used to provide an entrypoint to a private network, which means services that are gated by Chisel may be affected. Additionally, Chisel is often used for exposing services to the internet. An attacker could MITM requests by connecting to a Chisel server and requesting to forward traffic from a remote port. This issue has been addressed in release version 1.10.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-306\", \"description\": \"CWE-306: Missing Authentication for Critical Function\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-1068\", \"description\": \"CWE-1068: Inconsistency Between Implementation and Documented Design\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-08-26T22:32:43.575Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-43798\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-27T13:06:11.097Z\", \"dateReserved\": \"2024-08-16T14:20:37.325Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-08-26T22:32:43.575Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.