CVE-2018-10933— libssh server-side state machine 安全漏洞
一分钟漏洞结论
影响对象
[UNKNOWN] libssh
利用判断
存在公开或 AI PoC，应优先验证
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
libssh是一个用于访问SSH服务的C语言开发包，它能够执行远程命令、文件传输，同时为远程的程序提供安全的传输通道。server-side state machine是其中的一个服务器端状态机。 libssh的server-side state machine 0.7.6之前版本和0.8.4之前版本中存在安全漏洞。攻击者可借助恶意的客户端利用该漏洞在不进行身份验证的情况下创建通道，进而获取未授权的访问权限。
公开利用映射 3
Metasploit · 1
libssh_auth_bypass.rb [auxiliary]
已观察到在野利用
github_trending · low
可能的 ATT&CK 技术 3 AI
T1011.001 · Exfiltration Over Bluetooth T1133 · External Remote Services T1535.002
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2018-10933 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
N/A
来源: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.
来源: CVE Program / CVE List V5
CVSS Information
N/A
来源: CVE Program / CVE List V5
Vulnerability Type
CWE-592
来源: CVE Program / CVE List V5
Vulnerability Title
libssh server-side state machine 安全漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
libssh是一个用于访问SSH服务的C语言开发包，它能够执行远程命令、文件传输，同时为远程的程序提供安全的传输通道。server-side state machine是其中的一个服务器端状态机。 libssh的server-side state machine 0.7.6之前版本和0.8.4之前版本中存在安全漏洞。攻击者可借助恶意的客户端利用该漏洞在不进行身份验证的情况下创建通道，进而获取未授权的访问权限。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
二、漏洞 CVE-2018-10933 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|---|---|---|
| 1 | CVE-2018-10933 very simple POC | https://github.com/SoledaD208/CVE-2018-10933 | POC详情 |
| 2 | Spawn to shell without any credentials by using CVE-2018-10933 (LibSSH) | https://github.com/blacknbunny/CVE-2018-10933 | POC详情 |
| 3 | CVE-2018-10933 sshlib user authentication attack - docker lab, test and exploit | https://github.com/hook-s3c/CVE-2018-10933 | POC详情 |
| 4 | Leveraging it is a simple matter of presenting the server with the SSH2_MSG_USERAUTH_SUCCESS message, which shows that the login already occurred without a problem. The server expects the message SSH2_MSG_USERAUTH_REQUEST to start the authentication procedure, but by skipping it an attacker can log in without showing any credentials. | https://github.com/kn6869610/CVE-2018-10933 | POC详情 |
| 5 | Script to identify hosts vulnerable to CVE-2018-10933 | https://github.com/gojhonny/libssh-scanner | POC详情 |
| 6 | None | https://github.com/likescam/CVE-2018-10933_ssh | POC详情 |
| 7 | None | https://github.com/likescam/CVE-2018-10933-libSSH-Authentication-Bypass | POC详情 |
| 8 | Hunt for and Exploit the libSSH Authentication Bypass (CVE-2018-10933) | https://github.com/marco-lancini/hunt-for-cve-2018-10933 | POC详情 |
| 9 | cve-2018-10933 libssh authentication bypass | https://github.com/hackerhouse-opensource/cve-2018-10933 | POC详情 |
| 10 | None | https://github.com/cve-2018/cve-2018-10933 | POC详情 |
| 11 | libssh CVE-2018-10933 | https://github.com/jas502n/CVE-2018-10933 | POC详情 |
| 12 | Variant of hackerhouse-opensource/cve-2018-10933 | https://github.com/ninp0/cve-2018-10933_poc | POC详情 |
| 13 | None | https://github.com/pghook/CVE-2018-10933_Scanner | POC详情 |
| 14 | LibSSH Authentication Bypass Exploit using RCE | https://github.com/Virgula0/POC-CVE-2018-10933 | POC详情 |
| 15 | CVE-2018-10933 | https://github.com/shifa123/pythonprojects-CVE-2018-10933 | POC详情 |
| 16 | a python script to exploit libssh authentication vulnerability | https://github.com/xFreed0m/CVE-2018-10933 | POC详情 |
| 17 | CVE-2018-10933 | https://github.com/Bifrozt/CVE-2018-10933 | POC详情 |
| 18 | CVE-2018-10933 POC (LIBSSH) | https://github.com/r3dxpl0it/CVE-2018-10933 | POC详情 |
| 19 | A libssh CVE-2018-10933 scanner written in rust | https://github.com/ivanacostarubio/libssh-scanner | POC详情 |
| 20 | None | https://github.com/throwawayaccount12312312/precompiled-CVE-2018-10933 | POC详情 |
| 21 | Multi-threaded, reliable scanner for CVE-2018-10933. | https://github.com/reanimat0r/bpnd-libssh | POC详情 |
| 22 | None | https://github.com/ensimag-security/CVE-2018-10933 | POC详情 |
| 23 | Implementation of CVE-2018-10933 with CIDR block scanner | https://github.com/0xadaw/libSSH-bypass | POC详情 |
| 24 | libSSH bypass | https://github.com/sambiyal/CVE-2018-10933-POC | POC详情 |
| 25 | LibSSH Authentication Bypass CVE-2018-10933 | https://github.com/nikhil1232/LibSSH-Authentication-Bypass | POC详情 |
| 26 | Takes advantage of CVE-2018-10933 | https://github.com/Kurlee/LibSSH-exploit | POC详情 |
| 27 | None | https://github.com/crispy-peppers/Libssh-server-CVE-2018-10933 | POC详情 |
| 28 | Authentication Bypass in Server Code for LibSSH | https://github.com/youkergav/CVE-2018-10933 | POC详情 |
| 29 | None | https://github.com/kristyna-mlcakova/CVE-2018-10933 | POC详情 |
| 30 | None | https://github.com/lalishasanduwara/CVE-2018-10933 | POC详情 |
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2018-10933 的情报信息
请登录查看更多情报信息。
CVE-2018-10933 厂商安全公告 (7)
-
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html x_refsource_CONFIRM
-
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10933 x_refsource_CONFIRM
-
https://security.netapp.com/advisory/ntap-20190118-0002/ x_refsource_CONFIRM
-
-
-
-
CVE-2018-10933 公开利用代码 (1)
CVE-2018-10933 邮件列表归档 (1)
CVE-2018-10933 其他参考 (2)
-
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0016 x_refsource_CONFIRM
-
https://www.libssh.org/security/advisories/CVE-2018-10933.txt x_refsource_CONFIRM
IV. Related Vulnerabilities
V. Comments for CVE-2018-10933
暂无评论