CVE-2023-25136

[mastercho]

Template for?

CVE-2023-25136

Details:

I'm not sure which approach i should go with this template like, network protocol or ssh javascript?

id: CVE-2023-25136

info:
  name: OpenSSH server (sshd) 9.1 double-free vulnerability
  author: mastercho
  severity: critical
  description: |
    OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cwe-id: CWE-415
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-25136
    - https://jfrog.com/blog/openssh-pre-auth-double-free-cve-2023-25136-writeup-and-proof-of-concept/
  metadata:
    shodan-query: "OpenSSH_9.1"
    verified: "true"
  tags: network,ssh,openssh,critical

network:
  - host:
      - "{{Hostname}}"
      - "{{Host}}:22"

    matchers:
      - type: regex
        regex:
          - '(?i)OpenSSH_9\.1'

    extractors:
      - type: regex
        regex:
          - '(?i)SSH-(.*)-OpenSSH_[^\r]+'

Like that? According PoC https://github.com/ticofookfook/CVE-2023-25136 its also connect with no password if is valid vuln

[DhiyaneshGeek]

Hello @mastercho , thank you so much for sharing this template with the community and contributing to this project 🍻

In our repository, we aim to include CVEs along with complete POCs instead of solely relying on version detection. This approach helps avoid false positive results. So we are closing this issue

Feel Free to re-open this issue with Full POC

Thanks

[mastercho]

Hello @mastercho , thank you so much for sharing this template with the community and contributing to this project 🍻

In our repository, we aim to include CVEs along with complete POCs instead of solely relying on version detection. This approach helps avoid false positive results. So we are closing this issue

Feel Free to re-open this issue with Full POC

Thanks

But i open Template Request issue not Template Contribution, and im asking for help and directions, not like hey this is the template. You know that i would create template if i was know the approach...

[DhiyaneshGeek]

Hi @mastercho You can try to write a Javascript Template as follow , i have raised the drafted a PR #8914 for the same.

Thanks

id: CVE-2023-25136

info:
  name: OpenSSH Pre-Auth Double Free
  author: DhiyaneshDK
  severity: critical
  description: |
    OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states \"remote code execution is theoretically possible.
  metadata:
    shodan-query: "OpenSSH_9.1"
    verified: true
  tags: js,ssh,double-free,network

javascript:
  - pre-condition: |
      var m = require("nuclei/ssh");
      var c = m.SSHClient();
      var response = c.ConnectSSHInfoMode(Host, Port);
      response["UserAuth"].includes("password")
    code: |
      var m = require("nuclei/ssh");
      var c = m.SSHClient();
      c.Connect(Host,Port,Username,Password);

    args:
      Host: "{{Host}}"
      Port: "22"
      Username: " "
      Password: " "

    matchers:
      - type: dsl
        dsl:
          - "response == true"
          - "success == true"
        condition: and

[mastercho]

Thanks brother, shodan have lot ips on different ports than 22, can we use different port in javascript condition?

[DhiyaneshGeek]

Hi @mastercho

If no ports specified in the args as shown below, it will auto connect on pick port in input.

Hope this helps

Thanks

    args:
      Host: "{{Host}}"
      Port: ""
      Username: " "
      Password: " "

[gtrrnr]

Current template is missing crucial part that actually exploits vulnerability, empty login and password aren't causing double free.

The public exploit is causing DoS while connecting to vulnerable server with absolete CLIENT_ID:
https://github.com/jfrog/jfrog-CVE-2023-25136-OpenSSH_Double-Free/blob/main/cve-2023-25136.py#L4C1-L4C11

RCE is mentioned but only general technical information is provided and no exploit made public.

Here's proper writeup about issue:
https://jfrog.com/blog/openssh-pre-auth-double-free-cve-2023-25136-writeup-and-proof-of-concept/
And crash report:
https://bugzilla.mindrot.org/show_bug.cgi?id=3522

[DhiyaneshGeek]

Hi @gtrrnr we are aware of this and the template is on draft PR #8914