CVE-2023-43644

Published: Sep 25, 2023Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Sing-box is an open source proxy system. Affected versions are subject to an authentication bypass when specially crafted requests are sent to sing-box. This affects all SOCKS5 inbounds with user authentication and an attacker may be able to bypass authentication. Users are advised to update to sing-box 1.4.4 or to 1.5.0-rc.4. Users unable to update should not expose the SOCKS5 inbound to insecure environments.

Affected (16)

Products: Sagernet: Sing Box

Sagernet

1 product

Sing Box

Configuration A

16 vulnerable

Vulnerable Software	Affected Versions
Sagernet Sing Box	Before 1.4.5
Sagernet Sing Box	Version 1.5.0 beta10
Sagernet Sing Box	Version 1.5.0 beta11
Sagernet Sing Box	Version 1.5.0 beta12
Sagernet Sing Box	Version 1.5.0 beta1
Sagernet Sing Box	Version 1.5.0 beta2
Sagernet Sing Box	Version 1.5.0 beta3
Sagernet Sing Box	Version 1.5.0 beta4
Sagernet Sing Box	Version 1.5.0 beta5
Sagernet Sing Box	Version 1.5.0 beta6
Sagernet Sing Box	Version 1.5.0 beta7
Sagernet Sing Box	Version 1.5.0 beta8
Sagernet Sing Box	Version 1.5.0 beta9
Sagernet Sing Box	Version 1.5.0 rc1
Sagernet Sing Box	Version 1.5.0 rc2
Sagernet Sing Box	Version 1.5.0 rc3

Related CWEs

CWE-306

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (2)

https://github.com/SagerNet/sing-box/security/advisories/GHSA-r5hm-mp3j-285g

Source: security-advisories@github.com

Vendor Advisory

https://github.com/SagerNet/sing-box/security/advisories/GHSA-r5hm-mp3j-285g

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.