Rogue Session Attack in AsyncSSH: Control Over SSH Client Sessions
Summary
CVE-2023-46446: An issue in AsyncSSH before 2.14.1 allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulation, aka a "Rogue Session Attack.". Affects python-asyncssh across 2 version ranges.
< 0d6de9aec1a81a4f6ff7400c24b699eb6137fba3
< 2.5.0-0.1+deb11u1
Fixed in 2.5.0-0.1+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
AsyncSSH is a Python library that provides an asynchronous SSH client and server implementation. It is widely used for secure shell access and file transfers in Python applications. The library supports various SSH features, including key exchange, authentication, and encryption. However, a vulnerability has been identified that allows attackers to manipulate SSH client sessions, posing significant security risks.
Vulnerability Detail
An issue in AsyncSSH before version 2.14.1 allows attackers to perform a Rogue Session Attack. This vulnerability enables them to control the remote end of an SSH client session through packet injection or removal and shell emulation. The potential ramifications include unauthorized access to sensitive data, manipulation of commands, and disruption of services. The vulnerability arises from insufficient validation of incoming packets, which can be exploited by an attacker to hijack an active session.
How To Fix
Minimum fixed version
2.5.0-0.1+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-asyncsshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can implement network-level controls to restrict access to SSH services only from trusted IP addresses. Additionally, using SSH key-based authentication instead of password-based authentication can help mitigate risks until the library is updated.
Conclusion
The vulnerability in AsyncSSH poses a significant risk to SSH client sessions, allowing attackers to hijack sessions through packet manipulation. Users are strongly advised to upgrade to the latest version to protect against this threat. Implementing temporary workarounds can also help mitigate risks until the upgrade is completed.
See every vulnerability recorded for python-asyncssh →
FAQ
The CVSS score of this vulnerability is 6.8, indicating a medium severity level.
AsyncSSH versions prior to 2.14.1 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The potential impacts include unauthorized access to SSH sessions, data manipulation, and service disruptions.
Yes, implementing network-level controls and using SSH key-based authentication can help mitigate risks until the library is updated.
Related vulnerabilities
Recent vulnerabilities recorded for python-asyncssh.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
