CVE-2023-43644
published 2023-09-25CVE-2023-43644: Sing-box is an open source proxy system. Affected versions are subject to an authentication bypass when specially crafted requests are sent to sing-box. This…
PriorityP266critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.68%
47.7th percentile
Sing-box is an open source proxy system. Affected versions are subject to an authentication bypass when specially crafted requests are sent to sing-box. This affects all SOCKS5 inbounds with user authentication and an attacker may be able to bypass authentication. Users are advised to update to sing-box 1.4.4 or to 1.5.0-rc.4. Users unable to update should not expose the SOCKS5 inbound to insecure environments.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | sagernet_sing | >= 0 < 0.2.12-0.20230925092853-5b05b5c147d9 | 0.2.12-0.20230925092853-5b05b5c147d9 |
| github.com | sagernet_sing-box | >= 0 < 1.4.5 | 1.4.5 |
| github.com | sagernet_sing-box | >= 1.5.0-beta.1 < 1.5.0-rc.5 | 1.5.0-rc.5 |
| sagernet | sing-box | < 1.4.5 | 1.4.5 |
| sagernet | sing-box | — | — |
| sagernet | sing-box | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Authentication bypass in github.com/sagernet/sing
osv·2023-10-02
CVE-2023-43644 Authentication bypass in github.com/sagernet/sing
Authentication bypass in github.com/sagernet/sing
Authentication bypass in github.com/sagernet/sing
OSV
sing-box vulnerable to improper authentication in the SOCKS inbound
osv·2023-09-26
CVE-2023-43644 [CRITICAL] sing-box vulnerable to improper authentication in the SOCKS inbound
sing-box vulnerable to improper authentication in the SOCKS inbound
### Impact
This vulnerability allows specially crafted requests to bypass authentication, affecting all SOCKS inbounds with user authentication.
### Patches
Update to sing-box 1.4.5 or 1.5.0-rc.5 and later versions.
### Workarounds
Don't expose the SOCKS5 inbound to insecure environments.
GHSA
sing-box vulnerable to improper authentication in the SOCKS inbound
ghsa·2023-09-26
CVE-2023-43644 [CRITICAL] CWE-306 sing-box vulnerable to improper authentication in the SOCKS inbound
sing-box vulnerable to improper authentication in the SOCKS inbound
### Impact
This vulnerability allows specially crafted requests to bypass authentication, affecting all SOCKS inbounds with user authentication.
### Patches
Update to sing-box 1.4.5 or 1.5.0-rc.5 and later versions.
### Workarounds
Don't expose the SOCKS5 inbound to insecure environments.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-09-25
Published