CVE-2018-10933 PoC — libssh server-side state machine 安全漏洞

Source

https://github.com/youkergav/CVE-2018-10933

Associated Vulnerability

Title: libssh server-side state machine 安全漏洞 (CVE-2018-10933)
Description:A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.

Description

Authentication Bypass in Server Code for LibSSH

Readme

# Authentication Bypass in Server Code

CVE-2018-10933
Versions 0.7.6 to 0.8.4

## Description
libssh versions 0.6 and above have an authentication bypass vulnerability in the server code.  By presenting the server an SSH2_MSG_USERAUTH_SUCCESS message in place of the SSH2_MSG_USERAUTH_REQUEST message which the server would expect to initiate authentication, the attacker could successfully authentciate without any credentials.

The bug was discovered by Peter Winter-Smith of NCC Group.

## Installation
A POC demo of this vulnerability exists as a docker image.
```bash
cd ./CVE-2018-10933/docker
docker-compose up
```
## Credits
Docker image and vulnerability based off of <a href="https://github.com/hackerhouse-opensource/cve-2018-10933" target="_blank">https://github.com/hackerhouse-opensource/cve-2018-10933</a>.

Description based off of <a href="https://www.libssh.org/security/advisories/CVE-2018-10933.txt" target="_blank">https://www.libssh.org/security/advisories/CVE-2018-10933.txt</a>.

CVE based off of <a href="https://nvd.nist.gov/vuln/detail/CVE-2018-10933" target="_blank">https://nvd.nist.gov/vuln/detail/CVE-2018-10933</a>.

The bug was discovered by Peter Winter-Smith of NCC Group.

Patches are provided by the Anderson Toshiyuki Sasaki of Red Hat and the libssh team.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →