CVE-2024-43798

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-43798", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-08-16T14:20:37.325Z", "datePublished": "2024-08-26T22:32:43.575Z", "dateUpdated": "2024-08-27T13:06:11.097Z"}, "containers": {"cna": {"title": "Chisel AUTH environment variable not respected in server entrypoint", "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "lang": "en", "description": "CWE-306: Missing Authentication for Critical Function", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-1068", "lang": "en", "description": "CWE-1068: Inconsistency Between Implementation and Documented Design", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/jpillora/chisel/security/advisories/GHSA-38jh-8h67-m7mj", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/jpillora/chisel/security/advisories/GHSA-38jh-8h67-m7mj"}], "affected": [{"vendor": "jpillora", "product": "chisel", "versions": [{"version": "< 1.10.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-08-26T22:32:43.575Z"}, "descriptions": [{"lang": "en", "value": "Chisel is a fast TCP/UDP tunnel, transported over HTTP, secured via SSH. The Chisel server doesn't ever read the documented `AUTH` environment variable used to set credentials, which allows any unauthenticated user to connect, even if credentials were set. Anyone running the Chisel server that is using the `AUTH` environment variable to specify credentials to authenticate against is affected by this vulnerability. Chisel is often used to provide an entrypoint to a private network, which means services that are gated by Chisel may be affected. Additionally, Chisel is often used for exposing services to the internet. An attacker could MITM requests by connecting to a Chisel server and requesting to forward traffic from a remote port. This issue has been addressed in release version 1.10.0. All users are advised to upgrade. There are no known workarounds for this vulnerability."}], "source": {"advisory": "GHSA-38jh-8h67-m7mj", "discovery": "UNKNOWN"}}, "adp": [{"affected": [{"vendor": "jpillora", "product": "chisel", "cpes": ["cpe:2.3:a:jpillora:chisel:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "1.10.0", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-27T13:03:25.275313Z", "id": "CVE-2024-43798", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-27T13:06:11.097Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-43798", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-08-27T13:03:25.275313Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:jpillora:chisel:*:*:*:*:*:*:*:*"], "vendor": "jpillora", "product": "chisel", "versions": [{"status": "affected", "version": "0", "lessThan": "1.10.0", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-27T13:06:05.413Z"}}], "cna": {"title": "Chisel AUTH environment variable not respected in server entrypoint", "source": {"advisory": "GHSA-38jh-8h67-m7mj", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "jpillora", "product": "chisel", "versions": [{"status": "affected", "version": "< 1.10.0"}]}], "references": [{"url": "https://github.com/jpillora/chisel/security/advisories/GHSA-38jh-8h67-m7mj", "name": "https://github.com/jpillora/chisel/security/advisories/GHSA-38jh-8h67-m7mj", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Chisel is a fast TCP/UDP tunnel, transported over HTTP, secured via SSH. The Chisel server doesn't ever read the documented `AUTH` environment variable used to set credentials, which allows any unauthenticated user to connect, even if credentials were set. Anyone running the Chisel server that is using the `AUTH` environment variable to specify credentials to authenticate against is affected by this vulnerability. Chisel is often used to provide an entrypoint to a private network, which means services that are gated by Chisel may be affected. Additionally, Chisel is often used for exposing services to the internet. An attacker could MITM requests by connecting to a Chisel server and requesting to forward traffic from a remote port. This issue has been addressed in release version 1.10.0. All users are advised to upgrade. There are no known workarounds for this vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306: Missing Authentication for Critical Function"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1068", "description": "CWE-1068: Inconsistency Between Implementation and Documented Design"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-08-26T22:32:43.575Z"}}}, "cveMetadata": {"cveId": "CVE-2024-43798", "state": "PUBLISHED", "dateUpdated": "2024-08-27T13:06:11.097Z", "dateReserved": "2024-08-16T14:20:37.325Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-08-26T22:32:43.575Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "chisel", "vendor": "jpillora", "versions": [{"status": "affected", "version": "< 1.10.0"}]}], "source": "security-advisories@github.com"}, {"affectedData": [{"cpes": ["cpe:2.3:a:jpillora:chisel:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "chisel", "vendor": "jpillora", "versions": [{"lessThan": "1.10.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Chisel is a fast TCP/UDP tunnel, transported over HTTP, secured via SSH. The Chisel server doesn't ever read the documented `AUTH` environment variable used to set credentials, which allows any unauthenticated user to connect, even if credentials were set. Anyone running the Chisel server that is using the `AUTH` environment variable to specify credentials to authenticate against is affected by this vulnerability. Chisel is often used to provide an entrypoint to a private network, which means services that are gated by Chisel may be affected. Additionally, Chisel is often used for exposing services to the internet. An attacker could MITM requests by connecting to a Chisel server and requesting to forward traffic from a remote port. This issue has been addressed in release version 1.10.0. All users are advised to upgrade. There are no known workarounds for this vulnerability."}, {"lang": "es", "value": "Chisel es un t\u00fanel TCP/UDP r\u00e1pido, transportado a trav\u00e9s de HTTP y protegido mediante SSH. El servidor Chisel nunca lee la variable de entorno documentada \"AUTH\" utilizada para establecer las credenciales, lo que permite que cualquier usuario no autenticado se conecte, incluso si se configuraron las credenciales. Cualquiera que ejecute el servidor Chisel y utilice la variable de entorno `AUTH` para especificar las credenciales con las que autenticarse se ver\u00e1 afectado por esta vulnerabilidad. Chisel se utiliza a menudo para proporcionar un punto de entrada a una red privada, lo que significa que los servicios controlados por Chisel pueden verse afectados. Adem\u00e1s, Chisel se utiliza a menudo para exponer servicios a Internet. Un atacante podr\u00eda realizar solicitudes MITM conect\u00e1ndose a un servidor Chisel y solicitando reenviar tr\u00e1fico desde un puerto remoto. Este problema se solucion\u00f3 en la versi\u00f3n 1.10.0. Se recomienda a todos los usuarios que actualicen. No se conocen workarounds para esta vulnerabilidad."}], "id": "CVE-2024-43798", "lastModified": "2026-06-17T07:51:44.070", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-43798", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-08-27T13:03:25.275313Z", "version": "2.0.3"}}]}, "published": "2024-08-26T23:15:04.160", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/jpillora/chisel/security/advisories/GHSA-38jh-8h67-m7mj"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}, {"lang": "en", "value": "CWE-1068"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "chisel: From NVD collector", "id": "2308063", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2308063"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.6", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "status": "draft"}, "cwe": "(CWE-1068|CWE-306)", "details": ["Chisel is a fast TCP/UDP tunnel, transported over HTTP, secured via SSH. The Chisel server doesn't ever read the documented `AUTH` environment variable used to set credentials, which allows any unauthenticated user to connect, even if credentials were set. Anyone running the Chisel server that is using the `AUTH` environment variable to specify credentials to authenticate against is affected by this vulnerability. Chisel is often used to provide an entrypoint to a private network, which means services that are gated by Chisel may be affected. Additionally, Chisel is often used for exposing services to the internet. An attacker could MITM requests by connecting to a Chisel server and requesting to forward traffic from a remote port. This issue has been addressed in release version 1.10.0. All users are advised to upgrade. There are no known workarounds for this vulnerability."], "name": "CVE-2024-43798", "public_date": "2024-08-26T23:15:04Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-43798\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-43798\nhttps://github.com/jpillora/chisel/security/advisories/GHSA-38jh-8h67-m7mj"], "threat_severity": "Important"}

{}