CVE-2023-46446: AsyncSSH Rogue Session Attack
Summary
CVE-2023-46446: AsyncSSH Rogue Session Attack. Affects asyncssh versions < 2.14.1. Fixed in 2.14.1. How to fix ↓
Also tracked for
- python-asyncssh · Debian:11
The same CVE-2023-46446 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AsyncSSH is an open-source Python library that provides an asynchronous client and server implementation of the SSHv2 protocol. It allows users to establish secure shell connections and perform various SSH operations. However, versions up to and including 2.14.0 of AsyncSSH are vulnerable to a rogue session attack.
Vulnerability Detail
The rogue session attack in AsyncSSH allows an attacker with a shell account on the server to control the remote end of an SSH client session. By injecting and removing packets and emulating a shell, the attacker can log the client into their own account without detection. This grants the attacker complete control over the SSH session, including capturing user input, controlling terminal output, accessing forwarded network ports, and even creating signatures with a forwarded SSH Agent. The confidentiality and integrity of the secure channel are compromised, making it a significant vector for targeted phishing campaigns.
How To Fix
Latest published version: 2.24.1 as of 23 Oct 2026
pip install --upgrade "asyncssh==2.24.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.14.1
This is the first release that contains the fix.
pip install --upgrade "asyncssh==2.14.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of AsyncSSH as soon as possible.
Conclusion
The rogue session attack in AsyncSSH poses a significant security risk, allowing an attacker to gain complete control over an SSH client session. Users are strongly advised to upgrade to AsyncSSH version 2.14.1 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for asyncssh →
FAQ
The impact of this vulnerability depends on the application logic implemented by the AsyncSSH server. In the worst case, if the server starts a shell for the authenticated user upon connection, the attacker can perform perfect phishing attacks and become a Man-in-the-Middle at the application layer.
The attacker injects a chosen authentication request before the client's NewKeys. The authentication request must be a valid request containing the attacker's credentials. Due to a state machine flaw, the AsyncSSH server accepts the unauthenticated user authentication request message and defers it until the client requests the authentication protocol.
Versions up to and including 2.14.0 of AsyncSSH are affected by this vulnerability.
The only known mitigation is to upgrade to AsyncSSH version 2.14.1 or later, which includes a fix for the vulnerability.
Yes, the CVSS score for this vulnerability is 8.1.
References
Related vulnerabilities
Recent vulnerabilities recorded for asyncssh.
