PT-2024-26357 · Sshpiper · Sshpiper

Pgibson1-Godaddy · Published 2024-05-14 · Updated 2024-07-08 · CVE-2024-35175

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions sshpiper versions 1.0.50 through 1.2.x

Description The way the proxy protocol listener is implemented in sshpiper can allow an attacker to forge their connecting address. This means that any connection that sshpiper is directly or indirectly exposed to can use proxy protocol to forge its source address, potentially making logs less useful for whitelisting, rate limiting, or security investigations.

Recommendations For versions 1.0.50 through 1.2.x, upgrade to version 1.3.0 to patch the issue. As a temporary workaround, consider disabling the proxy protocol listener until a patch is available. Restrict access to sshpiper to minimize the risk of exploitation, ensuring it is only accessible in trusted environments.

Exploit

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2024-35175

GHSA-4W53-6JVP-GG52

GO-2024-2853

Affected Products

Sshpiper

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/35xxx/CVE-2024-35175.json · Exploit
• https://osv.dev/vulnerability/GHSA-4w53-6jvp-gg52 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-35175 · Security Note
• https://osv.dev/vulnerability/GO-2024-2853 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-35175 · Vendor Advisory
• https://github.com/tg123/sshpiper/security/advisories/GHSA-4w53-6jvp-gg52 · Note
• https://github.com/tg123/sshpiper · Note
• https://github.com/tg123/sshpiper/commit/2ddd69876a1e1119059debc59fe869cb4e754430 · Note
• https://github.com/tg123/sshpiper/commit/70fb830dca26bea7ced772ce5d834a3e88ae7f53 · Note
• https://t.me/cvenotify/79778 · Telegram Post
• https://twitter.com/oktsec/status/1810345487930732977 · Twitter Post
• https://t.me/cvenotify/79875 · Telegram Post