CVE-2024-35175: Insufficient Information (NVD-CWE-noinfo)
value: sshpiper is a reverse proxy for sshd. Starting in version 1.0.50 and prior to version 1.3.0, the way the proxy protocol listener is implemented in sshpiper can allow an attacker to forge their connecting address. Commit 2ddd69876a1e1119059debc59fe869cb4e754430 added the proxy protocol listener as the only listener in sshpiper, with no option to toggle this functionality off. This means that any connection that sshpiper is directly (or in some cases indirectly) exposed to can use proxy protocol to forge its source address. Any users of sshpiper who need logs from it for whitelisting/rate limiting/security investigations could have them become much less useful if an attacker is sending a spoofed source address. Version 1.3.0 contains a patch for the issue.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-14T22:15Z
Repository: https://github.com/tg123/sshpiper
Language: Go
Files changed: cmd/sshpiperd/daemon.go, cmd/sshpiperd/main.go, go.mod, go.sum
Commit date: 2022-07-08 01:58:22 +0000
Commit message: replace with proxy protocol listener

Diff: diff --git a/cmd/sshpiperd/daemon.go b/cmd/sshpiperd/daemon.go
index 8f603553..bf3a838a 100644
--- a/cmd/sshpiperd/daemon.go
+++ b/cmd/sshpiperd/daemon.go
@@ -67,13 +67,13 @@ func newDaemon(ctx *cli.Context) (*daemon, error) {
 func (d *daemon) install(plugins ...*plugin.GrpcPlugin) error {
 	if len(plugins) == 0 {
 		return fmt.Errorf("no plugins found")
 	}
 
-	// if len(plugins) == 1 {
-	// 	return plugins[0].InstallPiperConfig(d.config)
-	// }
+	if len(plugins) == 1 {
+		return plugins[0].InstallPiperConfig(d.config)
+	}
 
 	m := plugin.ChainPlugins{}
 
 	for _, p := range plugins {
 		if err := m.Append(p); err != nil {
diff --git a/cmd/sshpiperd/main.go b/cmd/sshpiperd/main.go
index fa4e724b..c75901ea 100644
--- a/cmd/sshpiperd/main.go
+++ b/cmd/sshpiperd/main.go
@@ -5,13 +5,13 @@ import (
 	"os"
 	"os/exec"
 	"runtime/debug"
 	"time"
 
+	"github.com/pires/go-proxyproto"
 	log "github.com/sirupsen/logrus"
 	"github.com/tg123/sshpiper/cmd/sshpiperd/internal/plugin"
-
 	"github.com/urfave/cli/v2"
 )
 
 var mainver string = "(devel)"
 
@@ -136,10 +136,12 @@ func main() {
 
 			if err != nil {
 				return err
 			}
 
+			d.lis = &proxyproto.Listener{Listener: d.lis}
+
 			var plugins []*plugin.GrpcPlugin
 
 			args := ctx.Args().Slice()
 			remain := args
 
diff --git a/cmd/sshpiperd/sshpiperd b/cmd/sshpiperd/sshpiperd
new file mode 100755
index 00000000..69aa3759
Binary files /dev/null and b/cmd/sshpiperd/sshpiperd differ
diff --git a/go.mod b/go.mod
index bab52035..8124dda4 100644
--- a/go.mod
+++ b/go.mod
@@ -9,10 +9,11 @@ require (
 	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.1.0
 	github.com/creack/pty v1.1.18
 	github.com/google/uuid v1.3.0
 	github.com/microsoft/kiota-authentication-azure-go v0.3.1
 	github.com/microsoftgraph/msgraph-sdk-go v0.28.0
+	github.com/pires/go-proxyproto v0.6.2
 	github.com/sirupsen/logrus v1.8.1
 	github.com/tg123/remotesigner v0.0.0-20210928104451-7c20285909d1
 	github.com/urfave/cli/v2 v2.10.3
 	golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d
 	google.golang.org/grpc v1.47.0
diff --git a/go.sum b/go.sum
index 18464ace..c3f2a2a0 100644
--- a/go.sum
+++ b/go.sum
@@ -87,10 +87,12 @@ github.com/microsoft/kiota-serialization-text-go v0.4.1/go.mod h1:DsriFnVBDCc4D8
 github.com/microsoftgraph/msgraph-sdk-go v0.28.0 h1:BolP/vNW7gsNXivg/qikcdftOicLMgMm3Z/6PpSFDvU=
 github.com/microsoftgraph/msgraph-sdk-go v0.28.0/go.mod h1:MB2iPD8vd8RTRAqlKTZfhLvE8OBiC/vjaOy8+J+nF1k=
 github.com/microsoftgraph/msgraph-sdk-go-core v0.26.1 h1:wzEoPk6uyd+SkBur9NpzpPfKseUQYT1yjFkDUueLpfk=
 github.com/microsoftgraph/msgraph-sdk-go-core v0.26.1/go.mod h1:cKWHZ9CfJnSvBJxzXnAXRA+SSy8JeAbS+4kOn3uyOIY=
 github.com/montanaflynn/stats v0.6.6/go.mod h1:etXPPgVO6n31NxCd9KQUMvCM+ve0ruNzt6R8Bnaayow=
+github.com/pires/go-proxyproto v0.6.2 h1:KAZ7UteSOt6urjme6ZldyFm4wDe/z0ZUP0Yv0Dos0d8=
+github.com/pires/go-proxyproto v0.6.2/go.mod h1:Odh9VFOZJCf9G8cLW5o435Xf1J95Jw9Gw5rnCjcwzAY=
 github.com/pkg/browser v0.0.0-20210115035449-ce105d075bb4 h1:Qj1ukM4GlMWXNdMBuXcXfz/Kw9s1qm0CLY32QxuSImI=
 github.com/pkg/browser v0.0.0-20210115035449-ce105d075bb4/go.mod h1:N6UoU20jOqggOuDwUaBQpluzLNDqif3kq9z2wpdYEfQ=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=

Vulnerable code: 	// if len(plugins) == 1 {
	// 	return plugins[0].InstallPiperConfig(d.config)
	// }

Fixed code: 	if len(plugins) == 1 {
		return plugins[0].InstallPiperConfig(d.config)
	}
	"github.com/pires/go-proxyproto"
			d.lis = &proxyproto.Listener{Listener: d.lis}

	github.com/pires/go-proxyproto v0.6.2
github.com/pires/go-proxyproto v0.6.2 h1:KAZ7UteSOt6urjme6ZldyFm4wDe/z0ZUP0Yv0Dos0d8=
github.com/pires/go-proxyproto v0.6.2/go.mod h1:Odh9VFOZJCf9G8cLW5o435Xf1J95Jw9Gw5rnCjcwzAY=