Chisel is a TCP/UDP tunnel, transported over HTTP and secured via SSH. In versions prior to 1.11.5, authenticated clients can bypass --authfile ACL restrictions and tunnel traffic to arbitrary destinations reachable from the server. The ACL is enforced only during the initial handshake against declared remotes, but never on subsequent SSH channels that carry actual traffic. A malicious client can authenticate with a permitted remote, then open channels to any host:port it wants. This issue has been fixed in version 1.11.5.

Affected: Go: github.com/jpillora/chisel

### Summary

Authenticated chisel clients can bypass `--authfile` ACL restrictions and tunnel traffic to arbitrary destinations reachable from the server. The ACL is enforced only during the initial handshake against declared remotes, but never on subsequent SSH channels that carry actual traffic. A malicious client authenticates with a permitted remote, then opens channels to any `host:port` it wants.

### Details The chisel server validates user ACLs in two places but is missing validation in one of the important places.

The `server/server_handler.go` checks the ACL, during the initial config handshake:

```go for _, r := range c.Remotes { if user != nil { addr := r.UserAddr() if !user.HasAccess(addr) { failed(s.Errorf("access to '%s' denied", addr)) return } } } r.Reply(true, nil) ```

This validates the declared remote list from the client's config request. It runs once, at connection setup. But in `share/tunnel/tunnel_out_ssh.go` ACL aren't being checked, when the server processes actual traffic channels:

```go func (t *Tunnel) handleSSHChannel(ch ssh.NewChannel) { remote := string(ch.ExtraData()) // client-controlled hostPort, proto := settings.L4Proto(remote) sshChan, reqs, err := ch.Accept() // accepted unconditionally // ... err = t.handleTCP(l, stream, hostPort) // dials whatever client said }

func (t *Tunnel) handleTCP(l *cio.Logger, src io.ReadWriteCloser, hostPort strin…