Cochise: Disabled SSH Host Key Verification Enables Second-Stage RCE

Vulnerability Overview Vulnerability Title: Cochise — Host Key Verification Disabled and Unsanitized Target Output Enable Second-Stage RCE Vulnerability ID: #13 Status: Open Affected Project: Cochise (LLM-driven penetration testing agent) Affected Files: - - Vulnerability Details 1. Vulnerability 1: Host Key Verification Disabled - at explicitly disables host key verification, enabling man-in-the-middle (MITM) attacks. - An attacker can intercept the SSH connection and proxy a malicious SSH server, completely bypassing the host key trust mechanism. 2. Vulnerability 2: Unsanitized Output in LLM Context - : SSH command output (including merged stdout/stderr) is not filtered, sanitized, or tagged, and is appended directly as a tool message to the LLM conversation history. - : Raw SSH output is appended to the conversation history as a tool message without sanitization or tagging. - The LLM processes this as context input, allowing an attacker to inject prompt-injection text that causes the LLM to generate malicious commands. 3. Vulnerability 3: Direct Function Execution of LLM Output - : Function calls generated by the LLM (including SSH commands) are executed directly without a parameter validation layer. Attack Chain 1. Cochise is instructed to penetrate a target (or connect to an attacker-controlled SSH server/MITM). 2. Cochise's SSH server returns malicious output in response to Cochise's commands. 3. The attacker's SSH server returns malicious output: 4. The complete output (including the injected instructions) enters the LLM context as a tool message. 5. The LLM generates a new SSH command: 6. executes this command on the target via the SSH connection. MITM Variant: 1. Cochise attempts to connect to a target (e.g., ). 2. An attacker on the network intercepts the connection ( , no verification). 3. The attacker's SSH proxy returns malicious output. 4. The injection chain is the same as described above. POC / Exploit Code (Target-Side) Set up the following on the target machine where Cochise connects: When Cochise connects and interacts with this service, the injected instructions enter the LLM context. Impact Second-Stage RCE: Commands generated by the LLM are executed on the target via the SSH connection; if the agent has access to the target (e.g., on the target), full host compromise is possible. MITM Exploitation: The disabled host key verification allows an attacker on the network to impersonate any SSH server, even if Cochise believes it is connecting to a legitimate target. Credential Leakage: Injected instructions can induce the agent to exfiltrate SSH keys, tokens, or other secrets stored on the connected system. Remediation 1. Enable Host Key Verification: Use a managed file or prompt the operator to verify new keys; remove . 2. Sanitize SSH Output Before Feeding the LLM: Escape or remove imperative patterns; use structured prompts to isolate tool output from system instructions. 3. Add a Command Validation Layer: Insert validation between LLM output and execution—detection for exfiltration patterns such as , , , , and require confirmation for sensitive operations. 4. Separate stderr from stdout: Error output should not be mixed into the LLM context.

Goal Reached Thanks to every supporter — we hit 100%!

Cochise: Disabled SSH Host Key Verification Enables Second-Stage RCE

More from this source