SSH Secure Shell for Servers 3.0.0 to 3.1.1 allows remote attackers to override the AllowedAuthentications configuration and use less secure authentication schemes (e.g. password) than configured for the server.
SSH Secure Shell for Servers versions 3.0.0 to 3.1.1 are vulnerable to a critical security flaw allowing remote attackers to bypass configured authentication restrictions. This vulnerability enables attackers to force the server to accept less secure authentication methods, such as password-based logins, potentially leading to complete system compromise and data breaches.
Step 1: Connection Initiation: The attacker initiates an SSH connection to the vulnerable server.
Step 2: Authentication Request Manipulation: The attacker crafts an SSH authentication request that includes a less secure authentication method (e.g., password) even if the server is configured to disallow it.
Step 3: Authentication Bypass: The server, due to the vulnerability, fails to properly validate the client's requested authentication methods against its configured AllowedAuthentications.
Step 4: Authentication Success: The server accepts the attacker's authentication request, allowing the attacker to authenticate using the less secure method (e.g., password) and gain unauthorized access.
The vulnerability stems from a flaw in how SSH Secure Shell for Servers handles the AllowedAuthentications configuration. The server fails to properly validate or enforce the configured authentication methods against the client's requested authentication types. This allows a malicious client to manipulate the authentication process, effectively overriding the server's security settings. The root cause is likely a logic error in the authentication handling code, where the client's requested authentication methods are not properly checked against the server's configured allowed methods. This could manifest as a missing or incorrect check, or a flawed implementation of the authentication negotiation process, allowing the client to force a less secure authentication method.