Executive brief
Paramiko, a widely used Python library for SSH connections, contains a flaw in its server-side implementation that allows attackers to bypass authentication. By using a modified SSH client, an unauthorized user can skip the login process and gain access to the server's functions, such as opening communication channels or executing commands. This could lead to full system compromise, unauthorized data access, or service disruption.
Technical details
An authentication bypass vulnerability exists in Paramiko's SSH server implementation within 'transport.py'. The root cause is a failure to validate the authentication state before processing connection-layer messages such as 'SSH_MSG_CHANNEL_OPEN'. A remote, unauthenticated attacker can use a customized SSH client to skip the 'SSH_MSG_USERAUTH_REQUEST' step and proceed directly to opening channels or requesting services. This allows for unauthorized command execution and data access on systems utilizing Paramiko as an SSH server. The issue is addressed in versions 1.17.6, 1.18.5, 2.0.8, 2.1.5, 2.2.3, 2.3.2, and 2.4.1.
Affected products
- Paramiko Paramiko < 1.17.6, 1.18.x < 1.18.5, 2.0.x < 2.0.8, 2.1.x < 2.1.5, 2.2.x < 2.2.3, 2.3.x < 2.3.2, 2.4.0
Timeline
- 2018-03-13: disclosed: NVD publication date
- 2018-07-12: advisory: GitHub Advisory published