CVE-2023-43644: Missing Authentication for Critical Function

September 25, 2023 (updated September 26, 2023)

Sing-box is an open source proxy system. Affected versions are subject to an authentication bypass when specially crafted requests are sent to sing-box. This affects all SOCKS5 inbounds with user authentication and an attacker may be able to bypass authentication. Users are advised to update to sing-box 1.4.4 or to 1.5.0-rc.4. Users unable to update should not expose the SOCKS5 inbound to insecure environments.

References

github.com/SagerNet/sing-box/security/advisories/GHSA-r5hm-mp3j-285g
nvd.nist.gov/vuln/detail/CVE-2023-43644

Code Behaviors & Features

Detect and mitigate CVE-2023-43644 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →