CVE-2018-3737: Vulnerability in sshpk package - ReDoS when parsing crafted invalid public keys in lib/formats/ssh.js

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

The sshpk package is a library for working with SSH keys in Node.js. It provides functionality for parsing, generating, and manipulating SSH keys. The vulnerability (CVE-2018-3737) arises from a Regular Expression Denial of Service (ReDoS) issue when parsing crafted invalid public keys in the lib/formats/ssh.js module.

Vulnerability Detail

The vulnerability allows an attacker to cause a Denial of Service (DoS) by sending specially crafted invalid public keys. When the sshpk package attempts to parse these keys, it enters into an inefficient regular expression matching process, leading to excessive CPU usage and potentially causing the application to become unresponsive. This vulnerability can be exploited remotely without authentication, making it a significant security concern.

sudo apt-get install --only-upgrade node-sshpk

Workaround

If updating the package is not immediately feasible, a temporary workaround is to implement input validation for SSH keys before passing them to the sshpk package. This can involve validating the key format and structure to ensure they meet the expected criteria. Here's an example of how to perform input validation in Node.js:

const sshpk = require('sshpk');

function validateSSHKey(key) {

try {

    sshpk.parseKey(key);
    return true;
  } catch (error) {
    return false;
  }
}

const key = '...'; // SSH key to validate

if (validateSSHKey(key)) {
  // Proceed with using the key
} else {
  // Handle invalid key
}

Conclusion

The sshpk package is vulnerable to a ReDoS issue when parsing crafted invalid public keys. This can lead to a Denial of Service (DoS) condition, potentially impacting the availability of the application. It is crucial to update the package to version 1.13.2 or later to fix the vulnerability. If immediate update is not possible, implementing input validation for SSH keys can serve as a temporary workaround. For further assistance on vulnerability remediation, please reach out to DevNack.com.

See every vulnerability recorded for node-sshpk →

FAQ