SSH 2.0.11 and earlier allows local users to request remote forwarding from privileged ports without being root.
SSH versions 2.0.11 and earlier are vulnerable to a critical security flaw allowing local users to request remote port forwarding from privileged ports without root privileges. This can lead to unauthorized access and system compromise, enabling attackers to bypass security controls and potentially gain control of sensitive network services. The vulnerability's age and the potential for exploitation on legacy systems make it a significant risk.
Step 1: Local User Access: A local user with an account on the vulnerable SSH server initiates a connection to the server using a standard SSH client.
Step 2: Forwarding Request: The local user crafts an SSH request to forward a connection from a privileged port (e.g., port 80 for HTTP) on the remote server to a port on the local machine.
Step 3: Server Processing: The vulnerable SSH server receives the forwarding request. Due to the vulnerability, the server fails to properly verify the user's privileges before accepting the request.
Step 4: Port Binding: The SSH server binds the specified privileged port on the remote host, effectively allowing the local user to control traffic destined for that port.
Step 5: Traffic Redirection: Any traffic directed to the privileged port on the remote server is now forwarded to the local machine, allowing the attacker to intercept or manipulate the traffic.
The vulnerability stems from a flaw in the SSH server's handling of remote port forwarding requests. Specifically, the server fails to properly validate whether a non-root user is authorized to request forwarding from privileged ports (ports below 1024). The SSH server, when receiving a request for remote port forwarding, does not adequately check the user's privileges before establishing the forwarding. This allows a local user to specify a privileged port as the destination for the forwarded connection, effectively bypassing the intended security restrictions. The root cause is a missing or inadequate access control check within the SSH server's code, specifically in the function responsible for handling remote port forwarding requests. This allows a non-privileged user to bind to a privileged port on the remote host, leading to a privilege escalation.