CVE-2024-43798 Chisel AUTH environment variable not respected in server entrypoint
Chisel server ignores the AUTH environment variable, allowing unauthenticated attackers to connect and potentially intercept traffic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-43798?
CVE-2024-43798 is a high-severity authentication bypass vulnerability in jpillora chisel, published on 26 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Chisel is a fast TCP/UDP tunnel, transported over HTTP, secured via SSH. The Chisel server doesn't ever read the documented `AUTH` environment variable used to set credentials, which allows any unauthenticated user to connect, even if credentials were set. Anyone running the Chisel server that is using the `AUTH` environment variable to specify credentials to authenticate against is affected by this vulnerability. Chisel is often used to provide an entrypoint to a private network, which means services that are gated by Chisel may be affected. Additionally, Chisel is often used for exposing services to the internet. An attacker could MITM requests by connecting to a Chisel server and requesting to forward traffic from a remote port. This issue has been addressed in release version 1.10.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Which versions are affected by CVE-2024-43798?
3 open source packages ship an affected version, including github.com/jpillora/chisel.
| Package | Affected | Fixed in |
|---|---|---|
github.com/jpillora/chisel Go | All versions | 1.10.0 |
github.com/jpillora/chisel Go | All versions | 1.10.0 |
github.com/jpillora/chisel Go | All versions | 1.10.0 |
How do I fix CVE-2024-43798?
Upgrade github.com/jpillora/chisel to 1.10.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-43798 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-43798 exists.
Sources
Also known as GHSA-38jh-8h67-m7mj, GO-2024-3100.