{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/frp--0.53.0--0.70.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["frp (\u003e= 0.53.0, \u003c= 0.70.0)","frps server (\u003e= 0.53.0, \u003c= 0.70.0)","SSH Tunnel Gateway (\u003e= 0.53.0, \u003c= 0.70.0)"],"_cs_severities":["high"],"_cs_tags":["denial-of-service","vulnerability","frp","integer-overflow"],"_cs_type":"advisory","_cs_vendors":["fatedier"],"content_html":"\u003cp\u003eAn integer-overflow vulnerability (CWE-190) has been identified in the frp server's optional SSH Tunnel Gateway (\u003ccode\u003efrps\u003c/code\u003e), affecting versions v0.53.0 through v0.70.0. This flaw allows any unauthenticated remote attacker to trigger a denial of service (DoS) by sending a single, malformed five-byte SSH \u003ccode\u003eexec\u003c/code\u003e channel request. The vulnerability stems from an integer overflow when parsing an attacker-controlled length field (\u003ccode\u003e0xFFFFFFFF\u003c/code\u003e), which causes a Go slice bounds check to fail, leading to an unhandled panic and the termination of the entire \u003ccode\u003efrps\u003c/code\u003e process. Since the attack is pre-authentication and does not require an authorized SSH key, it can be repeatedly exploited to maintain a sustained outage, disrupting all active frp tunnels and preventing new connections. This vulnerability significantly impacts the availability of affected \u003ccode\u003efrps\u003c/code\u003e instances with the SSH Tunnel Gateway enabled, which is not the default configuration.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated attacker establishes an SSH connection to a vulnerable \u003ccode\u003efrps\u003c/code\u003e server with the SSH Tunnel Gateway explicitly enabled and \u003ccode\u003eAuthorizedKeysFile\u003c/code\u003e unset (default configuration).\u003c/li\u003e\n\u003cli\u003eThe attacker opens an SSH session channel.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts an \u003ccode\u003eexec\u003c/code\u003e request payload consisting of five bytes.\u003c/li\u003e\n\u003cli\u003eThe first four bytes of the payload are set to \u003ccode\u003e0xFFFFFFFF\u003c/code\u003e (32-bit integer).\u003c/li\u003e\n\u003cli\u003eA single arbitrary byte (e.g., \u003ccode\u003e0x41\u003c/code\u003e) follows the four-byte length field.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003efrps\u003c/code\u003e server receives the \u003ccode\u003eexec\u003c/code\u003e request payload.\u003c/li\u003e\n\u003cli\u003eDuring parsing in \u003ccode\u003epkg/ssh/server.go\u003c/code\u003e, the server adds a constant \u003ccode\u003e4\u003c/code\u003e to the attacker-controlled length \u003ccode\u003e0xFFFFFFFF\u003c/code\u003e. Due to integer overflow, this calculation results in \u003ccode\u003e3\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe subsequent bounds check \u003ccode\u003elen(req.Payload) \u0026lt; int(end)\u003c/code\u003e evaluates to \u003ccode\u003e5 \u0026lt; 3\u003c/code\u003e, which is false, allowing the malicious payload to bypass the check.\u003c/li\u003e\n\u003cli\u003eA slice operation \u003ccode\u003ereq.Payload[4:end]\u003c/code\u003e is then executed, which becomes \u003ccode\u003ereq.Payload[4:3]\u003c/code\u003e, resulting in a \u0026quot;slice bounds out of range\u0026quot; panic.\u003c/li\u003e\n\u003cli\u003eThe unhandled panic causes the entire \u003ccode\u003efrps\u003c/code\u003e process to terminate, leading to a denial of service.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability results in an unauthenticated remote denial of service, causing the \u003ccode\u003efrps\u003c/code\u003e process to crash completely. This crash immediately drops all active tunnels, disconnecting every client and preventing any new connections. The attacker can repeatedly send the malicious five-byte payload to keep the service down indefinitely, making it a sustained outage. While there is no impact on confidentiality or integrity, and no code execution is achieved, the complete loss of service availability can be critical for organizations relying on \u003ccode\u003efrps\u003c/code\u003e for their tunneling infrastructure. This issue specifically affects \u003ccode\u003efrps\u003c/code\u003e instances where the SSH Tunnel Gateway feature is explicitly enabled, as it is disabled by default.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch affected frp installations immediately to a version beyond \u003ccode\u003ev0.70.0\u003c/code\u003e to remediate the integer overflow vulnerability affecting the SSH Tunnel Gateway.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible and the SSH Tunnel Gateway is not critical, disable the \u003ccode\u003esshTunnelGateway\u003c/code\u003e feature in your \u003ccode\u003efrps\u003c/code\u003e configuration to prevent exploitation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-24T21:53:22Z","date_published":"2026-07-24T21:53:22Z","id":"https://feed.craftedsignal.io/briefs/2026-07-frp-ssh-dos/","summary":"An unauthenticated remote denial-of-service vulnerability exists in the frp server's optional SSH Tunnel Gateway (frps) that allows an attacker to crash the entire frps process by sending a specially crafted five-byte message containing an integer overflow value in an SSH `exec` channel request, leading to a sustained service outage.","title":"frp: Unauthenticated Remote Denial of Service in SSH Tunnel Gateway via Integer Overflow","url":"https://feed.craftedsignal.io/briefs/2026-07-frp-ssh-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Frp (\u003e= 0.53.0, \u003c= 0.70.0)","version":"https://jsonfeed.org/version/1.1"}