Don’t Run Another Phish Test Until You Read This

Critical Advisory: OpenSSH Remote Code Execution Vulnerability

2nd July 2024 | Advisory, Blog

What Happened?

A critical vulnerability, tracked as CVE-2023-38408, has been discovered in OpenSSH’s ssh-agent, specifically affecting the agent’s forwarding feature. This vulnerability allows for remote code execution (RCE), potentially enabling attackers to execute arbitrary commands on a vulnerable system. At least 700,000 OpenSSH servers are known to be at risk.

“This vulnerability, if exploited, could lead to full system compromise where an attacker can execute arbitrary code with the highest privileges, resulting in complete system takeover, installation of malware, data manipulation and the creation of backdoors for persistent access.” – Bharat Jogi, Senior Director, Threat Research Unit, Qualys.

Immediate Steps to Take

Update OpenSSH: Promptly update to OpenSSH version 9.8p1, the latest release containing essential patches to address the vulnerability. This issue impacts OpenSSH versions from 8.5p1 to 9.7p1, making the update critical for security.
Principle of Least Privilege: Implement the Principle of Least Privilege across all systems and services. Ensure that software operates under non-privileged user accounts without administrative rights to minimize the impact of potential attacks. However, in this case, SSH needs to run as root to bind to port 22 and to switch to other users. Modern SSH daemons can do something called privilege separation. It is likely that this vulnerability still yields root access when exploited even with privilege separation.
Minimize Access: Restrict access to file shares, remote systems, and unnecessary services. Use tools like network concentrators, VPN gateways, and RDP gateways to enforce these access controls and enhance security. Limit access to SSH jump boxes where possible.

Protection and Prevention Measures:

Regular Updates: Ensure that all systems and applications are regularly updated with the latest security patches.
Configuration Management: Regularly review and manage configuration settings, particularly those related to authentication and remote access.
Network Segmentation: Segment your network to limit the potential impact of a compromised machine, reducing the risk of lateral movement by attackers.
User Education: Educate users about the risks of forwarding SSH agents and best practices for secure SSH usage.