CyberRota Analysis
AI-GeneratedThe frp reverse proxy, versions 0.53.0 to 0.70.1, is vulnerable due to improper handling of SSH exec channel requests, allowing an unauthenticated attacker to exploit a buffer overflow that can crash the frps process and disrupt all active tunnels. This vulnerability poses a high risk to environments using frp for SSH tunneling without proper client authentication configurations. Organizations utilizing affected versions of frp should prioritize upgrading to version 0.70.1 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel Gateway in pkg/ssh/server.go parses an SSH exec channel request by adding 4 to an attacker-controlled four-byte big-endian length. A length of 0xFFFFFFFF makes the uint32 addition wrap to 3, defeats the payload bounds check, and causes payload[4:3] to panic in TunnelServer.handleNewChannel. When no authorized-keys file is configured, sshConfig.NoClientAuth permits an unauthenticated peer to reach this channel phase before the frp token is checked, so a single five-byte request terminates the frps process and drops every active tunnel. This issue is fixed in version 0.70.1.