VYPR
← All advisories
Medium severity5.3NVD Advisory· Published May 14, 2024· Updated Apr 15, 2026

CVE-2024-35175

CVE-2024-35175

Description

sshpiper is a reverse proxy for sshd. Starting in version 1.0.50 and prior to version 1.3.0, the way the proxy protocol listener is implemented in sshpiper can allow an attacker to forge their connecting address. Commit 2ddd69876a1e1119059debc59fe869cb4e754430 added the proxy protocol listener as the only listener in sshpiper, with no option to toggle this functionality off. This means that any connection that sshpiper is directly (or in some cases indirectly) exposed to can use proxy protocol to forge its source address. Any users of sshpiper who need logs from it for whitelisting/rate limiting/security investigations could have them become much less useful if an attacker is sending a spoofed source address. Version 1.3.0 contains a patch for the issue.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/tg123/sshpiperGo
>= 1.0.50, < 1.3.01.3.0

Patches

2
70fb830dca26

Merge pull request from GHSA-4w53-6jvp-gg52

https://github.com/tg123/sshpiperBoshi LianMay 9, 2024via ghsa
commit
1 file changed · +16 −1
  • cmd/sshpiperd/main.go+16 −1 modified
    @@ -160,6 +160,11 @@ func main() {
 				Usage:   "filter out hostkeys-00@openssh.com which cause client side warnings",
 				EnvVars: []string{"SSHPIPERD_DROP_HOSTKEYS_MESSAGE"},
 			},
+			&cli.StringSliceFlag{
+				Name:  "allowed-proxy-addresses",
+				Value: cli.NewStringSlice(),
+				Usage: "allowed proxy addresses, only connections from these ip ranges are allowed to send a proxy header based on the PROXY protocol, empty will disable the PROXY protocol support",
+			},
 		},
 		Action: func(ctx *cli.Context) error {
 			level, err := log.ParseLevel(ctx.String("log-level"))
@@ -185,7 +190,17 @@ func main() {
 			}
 
 			quit := make(chan error)
-			d.lis = &proxyproto.Listener{Listener: d.lis}
+
+			allowedproxyaddresses := ctx.StringSlice("allowed-proxy-addresses")
+
+			if len(allowedproxyaddresses) > 0 {
+				proxypolicy, err := proxyproto.LaxWhiteListPolicy(allowedproxyaddresses)
+				if err != nil {
+					return err
+				}
+
+				d.lis = &proxyproto.Listener{Listener: d.lis, Policy: proxypolicy}
+			}
 
 			var plugins []*plugin.GrpcPlugin
2ddd69876a1e

replace with proxy protocol listener

https://github.com/tg123/sshpiperBoshi LianJul 8, 2022via ghsa
commit
5 files changed · +9 −4
  • cmd/sshpiperd/daemon.go+3 −3 modified
    @@ -69,9 +69,9 @@ func (d *daemon) install(plugins ...*plugin.GrpcPlugin) error {
 		return fmt.Errorf("no plugins found")
 	}
 
-	// if len(plugins) == 1 {
-	// 	return plugins[0].InstallPiperConfig(d.config)
-	// }
+	if len(plugins) == 1 {
+		return plugins[0].InstallPiperConfig(d.config)
+	}
 
 	m := plugin.ChainPlugins{}
  • cmd/sshpiperd/main.go+3 −1 modified
    @@ -7,9 +7,9 @@ import (
 	"runtime/debug"
 	"time"
 
+	"github.com/pires/go-proxyproto"
 	log "github.com/sirupsen/logrus"
 	"github.com/tg123/sshpiper/cmd/sshpiperd/internal/plugin"
-
 	"github.com/urfave/cli/v2"
 )
 
@@ -138,6 +138,8 @@ func main() {
 				return err
 			}
 
+			d.lis = &proxyproto.Listener{Listener: d.lis}
+
 			var plugins []*plugin.GrpcPlugin
 
 			args := ctx.Args().Slice()
  • cmd/sshpiperd/sshpiperd+0 −0 added
  • go.mod+1 −0 modified
    @@ -11,6 +11,7 @@ require (
 	github.com/google/uuid v1.3.0
 	github.com/microsoft/kiota-authentication-azure-go v0.3.1
 	github.com/microsoftgraph/msgraph-sdk-go v0.28.0
+	github.com/pires/go-proxyproto v0.6.2
 	github.com/sirupsen/logrus v1.8.1
 	github.com/tg123/remotesigner v0.0.0-20210928104451-7c20285909d1
 	github.com/urfave/cli/v2 v2.10.3
  • go.sum+2 −0 modified
    @@ -89,6 +89,8 @@ github.com/microsoftgraph/msgraph-sdk-go v0.28.0/go.mod h1:MB2iPD8vd8RTRAqlKTZfh
 github.com/microsoftgraph/msgraph-sdk-go-core v0.26.1 h1:wzEoPk6uyd+SkBur9NpzpPfKseUQYT1yjFkDUueLpfk=
 github.com/microsoftgraph/msgraph-sdk-go-core v0.26.1/go.mod h1:cKWHZ9CfJnSvBJxzXnAXRA+SSy8JeAbS+4kOn3uyOIY=
 github.com/montanaflynn/stats v0.6.6/go.mod h1:etXPPgVO6n31NxCd9KQUMvCM+ve0ruNzt6R8Bnaayow=
+github.com/pires/go-proxyproto v0.6.2 h1:KAZ7UteSOt6urjme6ZldyFm4wDe/z0ZUP0Yv0Dos0d8=
+github.com/pires/go-proxyproto v0.6.2/go.mod h1:Odh9VFOZJCf9G8cLW5o435Xf1J95Jw9Gw5rnCjcwzAY=
 github.com/pkg/browser v0.0.0-20210115035449-ce105d075bb4 h1:Qj1ukM4GlMWXNdMBuXcXfz/Kw9s1qm0CLY32QxuSImI=
 github.com/pkg/browser v0.0.0-20210115035449-ce105d075bb4/go.mod h1:N6UoU20jOqggOuDwUaBQpluzLNDqif3kq9z2wpdYEfQ=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.