Vulnerabilities > CVE-2023-43644 - Unspecified vulnerability in Sagernet Sing-Box

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

sagernet

critical

NVD

Published: 2023-09-25

Updated: 2024-11-21

Summary

Sing-box is an open source proxy system. Affected versions are subject to an authentication bypass when specially crafted requests are sent to sing-box. This affects all SOCKS5 inbounds with user authentication and an attacker may be able to bypass authentication. Users are advised to update to sing-box 1.4.4 or to 1.5.0-rc.4. Users unable to update should not expose the SOCKS5 inbound to insecure environments.

Vulnerable Configurations

Part	Description	Count
Application	Sagernet Sagernet Sing BOX - Sagernet Sing BOX 0.1.0 Sagernet Sing BOX 1.0 Sagernet Sing BOX 1.0.1 Sagernet Sing BOX 1.0.2 Sagernet Sing BOX 1.0.3 Sagernet Sing BOX 1.0.4 Sagernet Sing BOX 1.0.5 Sagernet Sing BOX 1.0.6 Sagernet Sing BOX 1.0.7 Sagernet Sing BOX 1.1.0 Sagernet Sing BOX 1.1.1 Sagernet Sing BOX 1.1.2 Sagernet Sing BOX 1.1.4 Sagernet Sing BOX 1.1.5 Sagernet Sing BOX 1.1.6 Sagernet Sing BOX 1.1.7 Sagernet Sing BOX 1.2.0 Sagernet Sing BOX 1.2.1 Sagernet Sing BOX 1.2.2 Sagernet Sing BOX 1.2.3 Sagernet Sing BOX 1.2.4 Sagernet Sing BOX 1.2.5 Sagernet Sing BOX 1.2.6 Sagernet Sing BOX 1.2.7 Sagernet Sing BOX 1.3.0 Sagernet Sing BOX 1.3.1 Sagernet Sing BOX 1.3.3 Sagernet Sing BOX 1.3.4 Sagernet Sing BOX 1.3.5 Sagernet Sing BOX 1.3.6 Sagernet Sing BOX 1.4.0 Sagernet Sing BOX 1.4.1 Sagernet Sing BOX 1.4.2 Sagernet Sing BOX 1.4.3 Sagernet Sing BOX 1.4.4 Sagernet Sing BOX 1.5.0	112

Summary

Vulnerable Configurations

References