Executive brief
Russh, a Rust-based SSH library, fails to verify if a communication channel is actually open before processing requests. This allows an authenticated user to bypass security policies that are supposed to restrict access to specific features like command execution or file transfers. In practice, an attacker could trigger sensitive operations (such as running scripts or accessing internal workflows) even if the server had explicitly denied their request to open a session.
Technical details
A logic flaw in `server_read_authenticated` within `russh/src/server/encrypted.rs` allows channel-scoped messages (e.g., SSH_MSG_CHANNEL_REQUEST, CHANNEL_DATA) to be dispatched to handler callbacks without verifying if the recipient ChannelId exists in the established channel table. An authenticated attacker can send crafted packets for arbitrary channel IDs to trigger callbacks such as `exec_request`, `shell_request`, or `subsystem_request` even if `channel_open_session` was never called or returned `false`. Additionally, `server_handle_channel_open` incorrectly retains application-side channel references for denied opens. The vulnerability is addressed in version 0.62.5 by ensuring the recipient channel is confirmed in the encrypted session's channel table before dispatching callbacks.
Affected products
- Eugeny russh <= 0.62.4
Timeline
- 2026-07-31: disclosed
- 2026-08-03: advisory
- 2026-08-03: patched: Fixed in version 0.62.5
References
- https://api.github.com/users/thesmartshadow
- https://github.com/thesmartshadow
- https://api.github.com/users/thesmartshadow/gists%7B/gist_id%7D
- https://api.github.com/users/thesmartshadow/repos
- https://avatars.githubusercontent.com/u/33183887?v=4
- https://api.github.com/users/thesmartshadow/events%7B/privacy%7D