CVE-2023-43644 : Exploit Details and Defense Strategies

This article provides an in-depth analysis of CVE-2023-43644, focusing on the improper authentication vulnerability in the SOCKS5 inbound in sing-box.

Understanding CVE-2023-43644

CVE-2023-43644 highlights the presence of an authentication bypass issue in sing-box, an open-source proxy system. This vulnerability allows an attacker to circumvent authentication mechanisms in SOCKS5 inbounds, potentially leading to unauthorized access.

What is CVE-2023-43644?

Sing-box, an open-source proxy system, is susceptible to an authentication bypass when specific malicious requests are directed at the SOCKS5 inbounds. Attackers could exploit this vulnerability to bypass authentication controls, posing a significant security risk.

The Impact of CVE-2023-43644

The impact of CVE-2023-43644 is critical, with a CVSS base severity score of 9.1 (Critical). It poses a high availability and confidentiality impact, potentially leading to unauthorized access to sensitive information.

Technical Details of CVE-2023-43644

The technical details of CVE-2023-43644 are as follows:

Vulnerability Description

The vulnerability arises due to missing authentication for critical functions (CWE-306) in the SOCKS5 inbound of sing-box. Malicious requests can exploit this flaw to bypass authentication mechanisms.

Affected Systems and Versions

The vulnerability affects the following versions of sing-box:

Versions < 1.4.5
Versions >= 1.5.0-beta.1, < 1.5.0-rc.4 Users operating these versions are at risk of exploitation and are strongly advised to take immediate action.

Exploitation Mechanism

Exploiting CVE-2023-43644 involves sending specially crafted requests to the SOCKS5 inbounds of sing-box. By leveraging this method, threat actors can bypass authentication controls and gain unauthorized access.

Mitigation and Prevention

To mitigate the risks associated with CVE-2023-43644, users and organizations should follow these guidelines:

Immediate Steps to Take

Update sing-box to version 1.4.5 or 1.5.0-rc.4 to eliminate the authentication bypass vulnerability.
Avoid exposing the SOCKS5 inbound to insecure environments to minimize the attack surface.

Long-Term Security Practices

Regularly monitor for security advisories and updates related to sing-box to stay informed about potential vulnerabilities.
Implement network segmentation and access controls to restrict unauthorized access to critical systems.

Patching and Updates

Stay vigilant for patches and updates released by SagerNet for sing-box. Promptly apply these patches to secure the SOCKS5 inbound and prevent exploitation of the vulnerability.