Dante is a widely used open-source SOCKS proxy server, trusted by system admins worldwide. In recent news, CVE-2024-54662 was disclosed—a security vulnerability in Dante versions 1.4. to 1.4.3, patched in 1.4.4. This post will explain in plain English what went wrong, show sample configurations, highlight exploit scenarios, and offer steps to protect your systems.

What is Dante?

Dante is a free SOCKS (SOCKet Secure) server and client suite developed by Inferno Nettverk A/S. Many organizations use Dante to control and secure access to services inside their networks, acting as a gatekeeper for incoming and outgoing traffic.

- Project page: https://www.inet.no/dante/
- Source repo: https://github.com/InfernoEmbedded/dante

What is CVE-2024-54662?

CVE-2024-54662 is a vulnerability found in Dante’s sockd (the proxy daemon), affecting versions 1.4. through 1.4.3. It involves incorrect access control logic, specifically in how sockd interprets the socksmethod configuration in sockd.conf files.

Simply put: If you mix and match authentication rules poorly, users might bypass required authentication and access your proxy without restrictions.

- CVE details: NVD entry

Which resources they can use

This is commonly done with a socksmethod line, which tells sockd how users must authenticate (for example, using passwords, or no authentication at all).

Here’s a simplified rule for SOCKS authentication

client pass {
    from: 192.168.1./24 to: .../
    protocol: tcp
    socksmethod: username, none
}

In this rule, clients from the local LAN (192.168.1./24) can connect and either provide a username or use no authentication at all.

Where Things Went Wrong

Between versions 1.4. and 1.4.3, a bug caused Dante to interpret the presence of the socksmethod option overly permissively. In some situations—especially when none is included alongside stronger options—users could be granted access without any real authentication, even when that was not the admin’s intention.

Example of an Unsafe Configuration

client pass {
    from: .../ to: .../
    socksmethod: username, none
}

The intention here might be: "Allow any users, but prefer username authentication."
The bug, however, allows ANY connection to bypass username authentication straight to 'none', leaving your proxy wide open.

Due to the bug, an attacker can connect using no authentication at all.

4. Proxy relay is granted: The attacker can now send traffic through the proxy—hiding their real IP, attacking other systems, or engaging in illicit activity.

In short: Your well-meaning settings are ignored, and attackers can ignore authentication.

Unsafe

client pass {
    from: .../ to: .../
    socksmethod: username, none  # Bug lets users skip auth
}

Safe (Post-1.4.4)

client pass {
    from: .../ to: .../
    socksmethod: username        # Only users with a username can connect
}

Tip: If you truly want to allow both unauthenticated and authenticated users, put them in _separate_ rules with different FROM addresses.

Patch and Fix

The bug is fixed in Dante 1.4.4. Developers updated the logic to properly enforce authentication requirements as declared.

- Release notes: https://www.inet.no/dante/doc/1.4.4/release_notes.html

Upgrade to Dante 1.4.4 or above.

Download: https://www.inet.no/dante/download.html

Review your sockd.conf file.

Check any socksmethod lines. Remove none unless explicitly desired, and never mix with secure methods in the same rule.

Final Thoughts

This bug in Dante is simple, but risky—especially for enterprise and hosting environments. If ignored, it makes your proxy a free-for-all relay, inviting abuse and blacklisting.

Keep your software updated, review config files carefully, and don’t trust default settings with access control.

References

- CVE-2024-54662 on NVD
- Official Dante Project
- Dante 1.4.4 Release Notes

Stay safe out there! 🌐🔒

*Did you find this explanation helpful? Share it with your fellow sysadmins and help keep the internet safe from open proxies.*

Timeline

Published on: 12/17/2024 18:15:24 UTC
Last modified on: 12/18/2024 16:15:14 UTC