CVE-2024-6387 PoC — Openssh: regresshion - race condition in ssh allows rce/dos

Source

https://github.com/paradessia/CVE-2024-6387-nmap

Associated Vulnerability

Title: Openssh: regresshion - race condition in ssh allows rce/dos (CVE-2024-6387)
Description:A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

Description

CVE-2024-6387-nmap

Readme

# OpenSSH Vulnerability Checker Nmap Script

## Description

The `openssh-vuln-checker.nse` script checks if a server is running a vulnerable version of OpenSSH(CVE-2024-6387). It connects to the SSH port, retrieves the SSH banner, and compares it against a list of known vulnerable versions.

## Vulnerable Versions

The script checks for the following vulnerable versions of OpenSSH:
- SSH-2.0-OpenSSH_8.5p1
- SSH-2.0-OpenSSH_8.6p1
- SSH-2.0-OpenSSH_8.7p1
- SSH-2.0-OpenSSH_8.8p1
- SSH-2.0-OpenSSH_8.9p1
- SSH-2.0-OpenSSH_9.0p1
- SSH-2.0-OpenSSH_9.1p1
- SSH-2.0-OpenSSH_9.2p1
- SSH-2.0-OpenSSH_9.3p1
- SSH-2.0-OpenSSH_9.4p1
- SSH-2.0-OpenSSH_9.5p1
- SSH-2.0-OpenSSH_9.6p1
- SSH-2.0-OpenSSH_9.7p1

## Reference
- https://ubuntu.com/security/CVE-2024-6387
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-6387
## Usage
- nmap --script openssh-vuln-checker -p 22 <target>

## Output
- PORT   STATE SERVICE
- 22/tcp open  ssh
- | openssh-vuln-checker:
- |   Server at <IP> is running SSH-2.0-OpenSSH_<version> (vulnerable)
- |_  Server at <IP> is not vulnerable (running SSH-2.0-OpenSSH_<version>)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →