CVE-2024-43798: Chisel Authentication Bypass Vulnerability

CVE-2024-43798 Overview

CVE-2024-43798 is an authentication bypass vulnerability in Chisel, a fast TCP/UDP tunnel transported over HTTP and secured via SSH. The Chisel server fails to read the documented AUTH environment variable used to set credentials. This flaw allows any unauthenticated user to connect to a Chisel server even when administrators have configured credentials. The vulnerability is tracked as CWE-306: Missing Authentication for Critical Function. The issue was resolved in Chisel version 1.10.0.

Critical Impact
Unauthenticated attackers can connect to Chisel servers and abuse port forwarding to pivot into private networks or perform man-in-the-middle attacks against services exposed through the tunnel.

Affected Products

Chisel server versions prior to 1.10.0 configured with the AUTH environment variable
Deployments using Chisel as an entrypoint to private networks
Deployments using Chisel to expose internal services to the internet

Discovery Timeline

2024-08-26 - CVE-2024-43798 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-43798

Vulnerability Analysis

The vulnerability stems from a discrepancy between Chisel's documentation and its implementation. Operators are instructed to set the AUTH environment variable to define server credentials. The Chisel server binary never reads that variable during initialization. The authentication layer is therefore initialized with no credential set, and the server accepts every client connection.

Chisel tunnels typically bridge untrusted networks with trusted ones. An attacker who reaches the Chisel HTTP endpoint can establish a tunnel session without supplying credentials. Once connected, the attacker can request remote port forwarding rules, intercepting traffic destined for legitimate services. This enables man-in-the-middle (MITM) attacks against any traffic routed through the compromised Chisel instance.

Root Cause

The root cause is missing authentication for a critical function [CWE-306]. The server-side configuration loader does not parse the AUTH environment variable into the credential store. Operators who follow the documentation believe authentication is enforced, while the server silently runs in an unauthenticated mode.

Attack Vector

The vulnerability is network-exploitable with no privileges and no user interaction. An attacker locates an exposed Chisel server, initiates a standard Chisel client session against the HTTP endpoint, and is admitted without presenting credentials. The attacker can then request reverse port forwarding to capture, redirect, or modify traffic. Technical details are documented in the GitHub Security Advisory GHSA-38jh-8h67-m7mj.

Detection Methods for CVE-2024-43798

Indicators of Compromise

Chisel server processes running versions earlier than 1.10.0 with AUTH set in the environment
Unexpected inbound connections to the Chisel HTTP listener from untrusted source IP addresses
Unauthorized remote port forwarding sessions visible in Chisel server logs
Outbound connections from the Chisel host to internal services that were not previously contacted

Detection Strategies

Inventory all Chisel deployments and confirm the binary version with chisel --version
Review Chisel server logs for client connections that should have been rejected by authentication
Correlate firewall and proxy logs for tunneled traffic patterns originating from Chisel hosts
Monitor process command lines and environment variables on hosts running Chisel to confirm credential configuration mode

Monitoring Recommendations

Alert on new TCP listeners or port forwards created on Chisel server hosts
Track authentication success and failure counts published by Chisel and alert on anomalies
Use network detection to flag Chisel protocol traffic from unexpected client networks

How to Mitigate CVE-2024-43798

Immediate Actions Required

Upgrade all Chisel servers to version 1.10.0 or later, which restores AUTH environment variable handling
Restrict network exposure of the Chisel listener to known administrative source addresses until patched
Rotate any credentials, tokens, or session data that may have transited an affected Chisel tunnel
Audit recent Chisel server logs for unauthorized client sessions and remote port forwards

Patch Information

The maintainer addressed the vulnerability in Chisel release 1.10.0. The fix restores parsing of the AUTH environment variable so that configured credentials are enforced on every incoming client session. Details are published in the GitHub Security Advisory GHSA-38jh-8h67-m7mj. The advisory states there are no known workarounds and all users should upgrade.

Workarounds

No vendor-supplied workaround exists; upgrading is the only supported remediation
As an interim control, place the Chisel listener behind a reverse proxy or VPN that enforces authentication independently
Block inbound access to the Chisel port at the perimeter firewall until the upgrade is complete

bash

# Verify the installed Chisel version and upgrade to the fixed release
chisel --version

# Example upgrade using the official release binary
curl -L https://github.com/jpillora/chisel/releases/download/v1.10.0/chisel_1.10.0_linux_amd64.gz \
  | gunzip > /usr/local/bin/chisel
chmod +x /usr/local/bin/chisel
chisel --version