CVE-2018-7749: AsyncSSH SSH Server Authentication Bypass

Background

AsyncSSH is a Python package available on PyPI that provides an asynchronous SSH server and client implementation. It allows users to establish secure connections and perform various SSH operations. The vulnerability in AsyncSSH versions before 1.12.1 allows an attacker to bypass authentication during SSH server connections. This can be exploited by a customized SSH client that skips the authentication step, potentially leading to unauthorized access and compromise of the server.

Vulnerability Detail

The vulnerability in AsyncSSH arises from the server implementation not properly checking whether authentication is completed before processing other requests. This flaw enables an attacker to establish a connection to the server without providing valid credentials. By exploiting this vulnerability, an attacker can bypass the authentication step and gain unauthorized access to the server. The impact of this vulnerability is critical, as it allows for unauthorized access and potential compromise of the server's resources and data.

pip install --upgrade "asyncssh==2.24.1"

pip install --upgrade "asyncssh==1.12.1"

Workaround

As a workaround, users can implement additional authentication checks within their SSH server implementation to ensure authentication is completed before processing other requests. This can be achieved by modifying the code to include proper authentication validation. Here is an example of how to add an authentication check in the asyncssh.connection.SSHConnection._recv_packet function:

import asyncssh

async def _recv_packet(self):
    if not self.is_authenticated():
        raise asyncssh.DisconnectError(
            asyncssh.DISCONNECT_PROTOCOL_ERROR, 'Authentication not completed')
    # Rest of the function code

Conclusion

The vulnerability in AsyncSSH versions before 1.12.1 allows an attacker to bypass authentication during SSH server connections. It is critical to upgrade to version 1.12.1 or later to fix this vulnerability. Implementing additional authentication checks within the SSH server implementation can serve as a workaround. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for asyncssh →

FAQ