CVE-2024-5732: Clash for Windows Auth Bypass Vulnerability

CVE-2024-5732 Overview

CVE-2024-5732 is an improper authentication vulnerability affecting Clash for Windows, a popular proxy client application. The vulnerability exists in the Proxy Port component and allows remote attackers to bypass authentication mechanisms. This security flaw has been classified as critical by the vulnerability database, with the exploit having been publicly disclosed. The affected versions include Clash up to version 0.20.1 on Windows systems.

Critical Impact

Remote attackers can exploit improper authentication in the Proxy Port component to gain unauthorized access to the proxy service, potentially enabling traffic interception, proxy abuse, or further system compromise.

Affected Products

• Clash for Windows version 0.20.1 and earlier
• Windows platform deployments of Clash proxy client
• Systems with exposed Proxy Port configurations

Discovery Timeline

• 2024-06-07 - CVE-2024-5732 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-5732

Vulnerability Analysis

This vulnerability stems from improper authentication (CWE-287) within the Proxy Port component of Clash for Windows. The core issue lies in how the application handles authentication for incoming proxy connections. Without proper authentication enforcement, the proxy service accepts connections from unauthorized sources, effectively operating as an open proxy.

The attack can be initiated remotely over the network without requiring any user interaction or prior authentication. An attacker who successfully exploits this vulnerability could leverage the compromised proxy to route malicious traffic, perform lateral movement within a network, or utilize the proxy infrastructure for further attacks while masking their true origin.

Root Cause

The root cause of CVE-2024-5732 is the absence or improper implementation of authentication mechanisms in the Proxy Port component. The application fails to adequately verify the identity of clients attempting to connect to the proxy service, allowing any network-accessible attacker to establish connections and utilize the proxy functionality without authorization.

Attack Vector

The vulnerability is exploitable via network access (AV:N) with low attack complexity. An attacker does not require any privileges or user interaction to exploit this flaw. The attack scenario involves:

1. An attacker identifies a Clash for Windows instance with an exposed Proxy Port
2. The attacker connects to the proxy service without providing valid credentials
3. Due to improper authentication, the connection is accepted
4. The attacker can then route traffic through the compromised proxy

Technical details and proof-of-concept information are available in the GitHub vulnerability disclosure and VulDB entry #267406.

Detection Methods for CVE-2024-5732

Indicators of Compromise

• Unexpected or unauthorized connections to the Clash proxy port from external IP addresses
• Unusual network traffic patterns originating from the Clash for Windows process
• Log entries showing successful proxy connections without proper authentication handshakes
• Increased outbound traffic volume inconsistent with normal user activity

Detection Strategies

• Monitor network connections to the configured Clash proxy port for unauthorized access attempts
• Implement network segmentation to detect lateral movement attempts through the proxy
• Review Clash for Windows logs for connection patterns from unknown or external sources
• Deploy network traffic analysis tools to identify proxy abuse patterns

Monitoring Recommendations

• Configure firewall rules to alert on unexpected inbound connections to Clash proxy ports
• Implement host-based intrusion detection to monitor the Clash for Windows process behavior
• Establish baseline network traffic patterns to detect anomalies indicative of proxy abuse
• Enable comprehensive logging on network perimeter devices to capture connection metadata

How to Mitigate CVE-2024-5732

Immediate Actions Required

• Review and modify Clash for Windows configuration to enable authentication on the proxy port
• Restrict proxy port access using host-based firewall rules to trusted IP addresses only
• Audit existing deployments to identify exposed instances that may be vulnerable
• Consider temporarily disabling the proxy service until proper authentication is configured

Patch Information

The recommended remediation is to change the configuration settings to enforce proper authentication. Users should consult the VulDB advisory and vulnerability details on GitHub for the latest mitigation guidance. It is strongly recommended to update to a version newer than 0.20.1 if available, or implement the configuration changes described in the security advisories.

Workarounds

• Bind the proxy port to localhost (127.0.0.1) to prevent remote network access
• Implement network-level access controls using firewalls to restrict proxy port access
• Use VPN or SSH tunneling if remote proxy access is required, adding an authentication layer
• Deploy a reverse proxy with authentication in front of the Clash proxy service

# Configuration example - Restrict proxy to localhost only
# In your Clash configuration file (config.yaml):
# Set the external controller and proxy to bind to localhost
external-controller: 127.0.0.1:9090
mixed-port: 7890
bind-address: 127.0.0.1

# Additionally, use Windows Firewall to block external access
netsh advfirewall firewall add rule name="Block Clash Proxy External" dir=in action=block protocol=tcp localport=7890 remoteip=any
netsh advfirewall firewall add rule name="Allow Clash Proxy Localhost" dir=in action=allow protocol=tcp localport=7890 remoteip=127.0.0.1