CVE-2023-48795 / Terrapin Attack

[carnil]

Hi

tinyssh seems prone to the Terrapin Attack (CVE-2023-48795) as well.

Details on: https://terrapin-attack.com/

Testing a recent version:

================================================================================
==================================== Report ====================================
================================================================================

Remote Banner: SSH-2.0-tinyssh_20230101-3 cWKeTzJf

ChaCha20-Poly1305 support:   true
CBC-EtM support:             false

Strict key exchange support: false

==> The scanned peer is VULNERABLE to Terrapin.

Note: This tool is provided as is, with no warranty whatsoever. It determines
      the vulnerability of a peer by checking the supported algorithms and
      support for strict key exchange. It may falsely claim a peer to be
      vulnerable if the vendor supports countermeasures other than strict key
      exchange.

For more details visit our website available at https://terrapin-attack.com

[janmojzis]

implementation kex-strict-s-v00@openssh.com: #82

[janmojzis]

'Terrapin Attack' allows the attacker MITM attack,
when they can drop some SSH packets without the server noticing it.

The worst impact of the attack for SSH key-exchange protocol is
that the attacker can drop some extension SSH packets such as EXT_INFO
and downgrade the connection's security.

Tinyssh does not support any such extension,
so downgrade attack is simply impossible by design.
And even if attacker injects some packet drops,
it will reach that the connection will be at most interrupted.

In summary,
Tinyssh can't be exploited throughout this vulnerability,
but SSH key-exchange design is vulnerable.
Openssh developers released an 'strict-key' key exchange
kex-strict-s-v00@openssh.com (and kex-strict-c-v00@openssh.com
for the client) which solves this problem.
In TinySSH implemented here:
#82
and will be included in the next release 20240101.

[lilyanatia]

kex-strict-s-v00@openssh.com does fix the vulnerability for clients that support it, but connections from clients without kex-strict-c-v00@openssh.com are still vulnerable.