Title

Localhost-filter bypass in SOCKS server mode

Description

In affected versions, the destination filter used by SOCKS server mode rejects IPv4 loopback addresses and the exact IPv6 loopback address, but does not reject several alternate address representations that can reach the local host. A client can therefore bypass the filter and connect to a service that is intended to be reachable only from the stunnel host.

The corrected filter rejects:

The behavior of unspecified and interface-scoped destinations depends on the operating system. IPv4-mapped IPv6 loopback addresses provide a directly reproducible bypass on affected IPv6-enabled systems.

Exploitability

The vulnerability is exploitable under the following conditions:

Impact

An untrusted SOCKS client may gain unintended access to services on the stunnel host. The resulting confidentiality or integrity impact depends entirely on the presence and security of those local services. High confidentiality impact is not inherent to stunnel itself, and no availability impact has been established. The practical risk is assessed as Moderate.

A SOCKS proxy is intentionally a general-purpose network-access facility. The filter prevents accidental access to the proxy host, but it is not a substitute for network policy, TLS client authentication, or access controls on local services.

CVSS v3.1 Score

CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Recommendation

Upgrade to stunnel 5.80 or later.

Until an upgrade is possible, disable SOCKS server mode when it is not needed. Otherwise, restrict the SOCKS listener with appropriate network policies and require TLS client authentication. Local services should retain their own authentication and access controls.

Credits

Timeline

Our supporters:
Go to the top