CVE-2024-5732
📋 TL;DR
This critical vulnerability in Clash for Windows allows remote attackers to bypass authentication on the proxy port component. Attackers can potentially gain unauthorized access to proxy configurations or intercept traffic. Users running Clash for Windows up to version 0.20.1 are affected.
💻 Affected Systems
- Clash for Windows
📦 What is this software?
Clash by Clashforwindows
⚠️ Risk & Real-World Impact
Worst Case
Remote attacker gains full control of proxy settings, intercepts all traffic, or uses the system as a proxy for malicious activities.
Likely Case
Unauthorized access to proxy configurations leading to traffic interception or redirection.
If Mitigated
Limited impact with proper network segmentation and authentication controls in place.
🎯 Exploit Status
Exploit has been publicly disclosed and appears to be straightforward to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None provided in CVE data
Restart Required: No
Instructions:
No official patch available. Follow workarounds and monitor for updates from Clash developers.
🔧 Temporary Workarounds
Change Proxy Port Configuration
windowsModify Clash configuration to implement proper authentication on proxy port
Edit Clash configuration file to add authentication requirements to proxy port settings
Network Segmentation
windowsRestrict access to Clash proxy port using firewall rules
netsh advfirewall firewall add rule name="Block Clash Proxy" dir=in action=block protocol=TCP localport=[YOUR_CLASH_PORT]
🧯 If You Can't Patch
- Disable or restrict the proxy port component entirely in Clash configuration
- Implement network-level controls to limit access to the Clash proxy port
🔍 How to Verify
Check if Vulnerable:
Check Clash for Windows version in application settings or About section. If version is 0.20.1 or earlier, you are vulnerable.Check Version:
Check Clash GUI → Settings → About for version informationVerify Fix Applied:
Verify configuration changes by testing proxy port access with authentication requirements.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to proxy port
- Configuration changes without authentication
Network Indicators:
- Unexpected traffic to/from Clash proxy port
- Proxy connections from unauthorized sources
SIEM Query:
source_port:[CLASH_PROXY_PORT] AND (NOT user:[AUTHENTICATED_USER])🔗 References
- https://github.com/GTA12138/vul/blob/main/clash%20for%20windows.md
- https://vuldb.com/?ctiid.267406
- https://vuldb.com/?id.267406
- https://vuldb.com/?submit.345469
- https://github.com/GTA12138/vul/blob/main/clash%20for%20windows.md
- https://vuldb.com/?ctiid.267406
- https://vuldb.com/?id.267406
- https://vuldb.com/?submit.345469
