How to fix CVE-2024-45337 – Step-by-Step Guide
CVE-2024-45337 addresses a critical authentication bypass vulnerability in Go's crypto/ssh package. This flaw, with a CVSS score of 9.1, allows unauthorized access to SSH servers. It impacts Go applications using ServerConfig.PublicKeyCallback for authentication.
What is Go crypto/ssh – Misuse of ServerConfig.PublicKeyCallback?
This vulnerability stems from a logic flaw in crypto/ssh's ServerConfig.PublicKeyCallback. Applications may incorrectly authorize connections if the callback approves a key, even if subsequent authentication fails. This bypasses security checks, enabling unauthorized access to SSH servers.
Impact and Risks for your Infrastructure
The primary impact is an unauthorized SSH authentication bypass in vulnerable Go applications. Attackers can leverage this flaw to authenticate to affected SSH servers using any public key, gaining unauthorized access. This could lead to data breaches or full system compromise.
Step-by-Step Mitigation Guide
To mitigate, update your Go applications to Go 1.22.10+ or Go 1.23.4+. Verify the update by checking your Go version and recompiling affected applications. Ensure your go.mod file reflects the updated Go version to apply the patch effectively.
- 1Upgrade Go to 1.22.10+ or 1.23.4+.
- 2Review your PublicKeyCallback implementation to ensure it rejects unauthorized keys.
- 3Add explicit key allowlist validation inside PublicKeyCallback.
- 4Rotate SSH host keys and audit SSH access logs for anomalies.
- 5Run static analysis (govulncheck) to detect usage of vulnerable patterns.
- 6Pin allowed public keys in your callback rather than relying on post-callback checks.