CVE-2018-10933 PoC — libssh server-side state machine 安全漏洞

Description

Authentication Bypass in Server Code for LibSSH

介绍

# Authentication Bypass in Server Code

CVE-2018-10933
Versions 0.7.6 to 0.8.4

## Description
libssh versions 0.6 and above have an authentication bypass vulnerability in the server code.  By presenting the server an SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST message which the server would expect to initiate authentication, the attacker could successfully authentciate without any credentials.

The bug was discovered by Peter Winter-Smith of NCC Group.

## Installation
A POC demo of this vulnerability exists as a docker image.
```bash
cd ./CVE-2018-10933/docker
docker-compose up
```
## Credits
Docker image and vulnerability based off of <a href="https://github.com/hackerhouse-opensource/cve-2018-10933" target="_blank">https://github.com/hackerhouse-opensource/cve-2018-10933</a>.

Description based off of <a href="https://www.libssh.org/security/advisories/CVE-2018-10933.txt" target="_blank">https://www.libssh.org/security/advisories/CVE-2018-10933.txt</a>.

CVE based off of <a href="https://nvd.nist.gov/vuln/detail/CVE-2018-10933" target="_blank">https://nvd.nist.gov/vuln/detail/CVE-2018-10933</a>.

The bug was discovered by Peter Winter-Smith of NCC Group.

Patches are provided by the Anderson Toshiyuki Sasaki of Red Hat and the libssh team.

文件快照

备注