CVE-2024-5732

Executive Summary

CVE-2024-5732 is a critical vulnerability affecting Clash up to version 0.20.1 on Windows. The flaw resides in the Proxy Port component, allowing remote attackers to bypass authentication. With a CVSS score of 0.0 (placeholder), the actual risk is severe due to the lack of authentication requirements. The exploit has been publicly disclosed, increasing the threat of widespread attacks. No official patch exists, and mitigation relies on configuration changes.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects the Clash proxy application, which is typically distributed as a standalone binary for Windows.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): High (H) – Full data access possible.
• Integrity (I): High (H) – Full data modification possible.
• Availability (A): High (H) – Full service disruption possible.

Threat Level: Critical. The combination of remote exploitability, low complexity, and no authentication makes this a high-priority target for attackers.

Deep Dive & Mechanics

The vulnerability exists in the Proxy Port component of Clash on Windows. The exact mechanism involves improper authentication handling, allowing an attacker to send crafted requests to the proxy port without valid credentials. This can lead to unauthorized access to the proxy service, potentially enabling traffic interception, redirection, or manipulation.

The exploit has been publicly disclosed, meaning technical details are available to threat actors. The lack of a patch forces reliance on configuration changes, such as restricting access to the proxy port via firewall rules or disabling the vulnerable feature.

Vulnerable vs. Patched Code

Since no official patch exists, there is no patched code to compare. The vulnerable code is present in Clash versions up to 0.20.1 on Windows. The recommended mitigation is to change configuration settings, which may involve:

• Disabling the Proxy Port feature.
• Restricting network access to the proxy port (e.g., using firewall rules).
• Implementing additional authentication mechanisms (if supported).

Exploitation & Lab Setup

Red Team

To simulate exploitation, set up a controlled lab environment with Clash 0.20.1 on Windows. Use the following steps:

1. Install Clash on a Windows VM.
2. Ensure the Proxy Port is exposed (default 7890).
3. Send a crafted request to the proxy port without authentication:

curl -x http://target:7890 http://example.com

If the proxy forwards the request without authentication, the vulnerability is confirmed.

Blue Team

To detect exploitation attempts, monitor network traffic for unauthorized access to the proxy port. Use the following detection rules:

• Network: Look for connections to port 7890 from unexpected sources.
• Logs: Check Clash logs for authentication failures or unusual requests.

Indicators of Compromise (IOCs)

• Network: Unauthorized connections to Clash proxy port (default 7890).
• Logs: Clash log entries showing requests without authentication.
• Process: Clash.exe running with exposed proxy port.

Detection Engineering

YARA Rule

rule CVE_2024_5732_Clash_Proxy {
    meta:
        description = "Detects Clash proxy configuration files vulnerable to CVE-2024-5732"
        author = "Valters IT"
        date = "2025-04-16"
    strings:
        $s1 = "port: 7890" nocase
        $s2 = "socks-port: 7891" nocase
        $s3 = "allow-lan: true" nocase
    condition:
        any of ($s*) and filesize < 10KB
}

Sigma Rule

title: CVE-2024-5732 Clash Proxy Authentication Bypass
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthorized access attempts to Clash proxy port
author: Valters IT
date: 2025-04-16
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationPort: 7890
        Initiated: true
    condition: selection
falsepositives:
    - Legitimate proxy usage
level: high

Suricata Rule

alert tcp any any -> any 7890 (msg:"CVE-2024-5732 Clash Proxy Authentication Bypass"; flow:to_server; content:"CONNECT"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Configuration Change: Modify Clash configuration to disable the Proxy Port or restrict access via allow-lan: false.
2. Firewall Rules: Block inbound connections to port 7890 from untrusted networks.
3. Network Segmentation: Isolate Clash instances from public networks.
4. Monitor: Implement detection rules to identify exploitation attempts.
5. Update: Watch for official patches from the Clash project.

Valters IT
DevSecOps & Cyber Threat Intelligence