{"answers":{"affected":"3 open source packages ship an affected version, including github.com/jpillora/chisel.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-43798 exists.","fix":"Upgrade github.com/jpillora/chisel to 1.10.0 or later.","what":"CVE-2024-43798 is a high-severity authentication bypass vulnerability in jpillora chisel, published on 26 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2024-43798 and fix it if it is affected.\n\nWhat it is: CVE-2024-43798 is a high-severity authentication bypass vulnerability in jpillora chisel, published on 26 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-43798 exists.\n\nAffected packages and fixed versions:\n- github.com/jpillora/chisel (Go): affected all versions; fixed in 1.10.0\n- github.com/jpillora/chisel (Go): affected all versions; fixed in 1.10.0\n- github.com/jpillora/chisel (Go): affected all versions; fixed in 1.10.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-43798/ (Markdown: https://insights.sbomify.com/CVE-2024-43798/index.md)","id":"CVE-2024-43798","markdown":"https://insights.sbomify.com/CVE-2024-43798/index.md","name":"CVE-2024-43798","record":{"aliases":["GHSA-38jh-8h67-m7mj","GO-2024-3100"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["security_bypass","data_read"],"network_reachable":"yes","non_default_config":true,"product_category":"TCP/UDP tunnel server","requires_auth":"none","summary":"Chisel server ignores the AUTH environment variable, allowing unauthenticated attackers to connect and potentially intercept traffic.","user_interaction":"not_required","vuln_class":"auth_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":8.6,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-306","name":"Missing Authentication for Critical Functionality"},{"id":"CWE-1068","name":"Inconsistency Between Implementation and Documented Design"}],"description":"Chisel is a fast TCP/UDP tunnel, transported over HTTP, secured via SSH. The Chisel server doesn't ever read the documented `AUTH` environment variable used to set credentials, which allows any unauthenticated user to connect, even if credentials were set. Anyone running the Chisel server that is using the `AUTH` environment variable to specify credentials to authenticate against is affected by this vulnerability. Chisel is often used to provide an entrypoint to a private network, which means services that are gated by Chisel may be affected. Additionally, Chisel is often used for exposing services to the internet. An attacker could MITM requests by connecting to a Chisel server and requesting to forward traffic from a remote port. This issue has been addressed in release version 1.10.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.","ecosystems":["Go"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"Chisel AUTH environment variable not respected in server entrypoint","id":"CVE-2024-43798","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Go","product":null,"products":[],"type":"auth_bypass","year":"2024"},"n_packages":3,"n_references":1,"next":{"headline":"send vulnerable to template injection that can lead to XSS","id":"CVE-2024-43799"},"packages":[{"ecosystem":"Go","fixed":["1.10.0"],"introduced":["0"],"last_affected":[],"package":"github.com/jpillora/chisel","purl":null,"source":"GHSA-38jh-8h67-m7mj"},{"ecosystem":"Go","fixed":["1.10.0"],"introduced":["0"],"last_affected":[],"package":"github.com/jpillora/chisel","purl":"pkg:golang/github.com/jpillora/chisel","source":"GHSA-38jh-8h67-m7mj"},{"ecosystem":"Go","fixed":["1.10.0"],"introduced":["0"],"last_affected":[],"package":"github.com/jpillora/chisel","purl":"pkg:golang/github.com/jpillora/chisel","source":"GO-2024-3100"}],"prev":{"headline":"Path Traversal in audiobookshelf","id":"CVE-2024-43797"},"products":["chisel"],"published":"2024-08-26","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"total"},"state":"PUBLISHED","updated":"2024-08-27","vendors":["jpillora"]},"summary":"Chisel server ignores the AUTH environment variable, allowing unauthenticated attackers to connect and potentially intercept traffic.","url":"https://insights.sbomify.com/CVE-2024-43798/"}