Read the docs
TI-2024-23249 Aliases CVE-2024-35175GHSA-4w53-6jvp-gg52

sshpiper's Enabling of Proxy Protocol without proper feature flagging allows faking source address

Priority MEDIUM 63CWE-345Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-345.

Summary

sshpiper is a reverse proxy for sshd. Starting in version 1.0.50 and prior to version 1.3.0, the way the proxy protocol listener is implemented in sshpiper can allow an attacker to forge their connecting address. Commit 2ddd69876a1e1119059debc59fe869cb4e754430 added the proxy protocol listener as the only listener in sshpiper, with no option to toggle this functionality off. This means that any connection that sshpiper is directly (or in some cases indirectly) exposed to can use proxy protocol to forge its source address. Any users of sshpiper who need logs from it for whitelisting/rate limiting/security investigations could have them become much less useful if an attacker is sending a spoofed source address. Version 1.3.0 contains a patch for the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0026 17th percentileScored 2026-11-07
Fix Fixed sshpiper (tg123): 1.3.0github.com/tg123/sshpiper (Go): 1.3.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
tg123sshpiper1.0.50 to before 1.3.01.3.0Patch availableCNA
—github.com/tg123/sshpiper (Go)1.0.50 to before 1.3.01.3.0Patch availableGHSA-4w53-6jvp-gg52
  • sshpiper Vendortg123 Affected 1.0.50 to before 1.3.0 Fixed in 1.3.0 Patch available CNA
  • github.com/tg123/sshpiper (Go) Vendor— Affected 1.0.50 to before 1.3.0 Fixed in 1.3.0 Patch available GHSA-4w53-6jvp-gg52

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:tg123:sshpiper:*:*:*:*:*:*:*:*——tg123
  • cpe:2.3:a:tg123:sshpiper:*:*:*:*:*:*:*:* Versions — — ·tg123

Remediation

  • Fix · CNA sshpiper (tg123) Fixed in 1.3.0
  • Fix · GHSA-4w53-6jvp-gg52 github.com/tg123/sshpiper (Go) Fixed in 1.3.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-35175
  2. 2026-10-03 Alias added: GHSA-4w53-6jvp-gg52

References

Advisory 1

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences