CVE-2024-54662

What it actually does

Incorrect access control in sockd.conf configurations involving socksmethod permits unauthorized network access without proper authentication.

Why it matters to the business

Attackers may gain unauthorized entry to internal services, risking data exposure or operational disruption on affected proxy deployments; low ecosystem prevalence and stable EPSS reduce immediate widespread risk.

How an attack unfolds

An attacker identifies a Dante instance with permissive socksmethod settings, sends crafted connection requests that bypass intended authorization checks, and obtains access to proxied resources.

How to fix it

Upgrade Dante to version 1.4.4; for listed Ubuntu wpa packages apply the corresponding fixed versions such as 2.1-0ubuntu1.5 on 14.04 LTS, 2.4-0ubuntu6.2 on 16.04 LTS, or 2.4-0ubuntu10 on 18.04 LTS.

How to confirm the fix worked

Verify running Dante version is 1.4.4 or newer; confirm sockd.conf uses only secure socksmethod values; test connection attempts from unprivileged sources are denied.

Typical attack path

1. Scan for exposed Dante sockd services on the network
2. Inspect or infer sockd.conf socksmethod configuration weaknesses
3. Send authentication-bypassing connection requests to the proxy
4. Establish unauthorized sessions to internal destinations

How to detect it

Review proxy access logs for successful connections from unexpected sources; inspect configuration files for permissive socksmethod entries; correlate with network flow data showing unauthorized proxy usage.

What your security team should do

• Prioritize upgrade of all Dante instances to fixed version 1.4.4 within standard patch windows
• Audit sockd.conf files for socksmethod settings across the environment
• Monitor EPSS and threat feeds for any rise in exploitation activity