How to fix CVE-2024-45337 – Step-by-Step Guide
CVE-2024-45337 addresses a critical authentication bypass in Go's `crypto/ssh` package. This flaw, rated CVSS 9.1, impacts applications using `ServerConfig.PublicKeyCallback`. It allows unauthorized SSH access due to a logic error in key validation.
What is Go crypto/ssh – Misuse of ServerConfig.PublicKeyCallback?
This vulnerability stems from a logic flaw in Go's `crypto/ssh` server authentication. When `ServerConfig.PublicKeyCallback` approves a public key, the authentication flow may incorrectly proceed even if subsequent authentication steps fail. This bypasses intended security checks, granting unauthorized access.
Impact and Risks for your Infrastructure
Attackers can exploit this flaw to bypass SSH authentication in affected Go applications. This leads to unauthorized access to sensitive systems, potentially resulting in data exfiltration, system compromise, or further network penetration. Critical infrastructure running vulnerable Go SSH servers is at high risk.
Step-by-Step Mitigation Guide
To mitigate CVE-2024-45337, upgrade your Go applications to Go 1.22.10+ or Go 1.23.4+. Recompile and redeploy all affected services. Verify the fix by ensuring your application's Go version is updated and conducting thorough authentication tests.
- 1Upgrade Go to 1.22.10+ or 1.23.4+.
- 2Review your PublicKeyCallback implementation to ensure it rejects unauthorized keys.
- 3Add explicit key allowlist validation inside PublicKeyCallback.
- 4Rotate SSH host keys and audit SSH access logs for anomalies.
- 5Run static analysis (govulncheck) to detect usage of vulnerable patterns.
- 6Pin allowed public keys in your callback rather than relying on post-callback checks.