CVE-2025-23390

Executive Summary

CVE-2025-23390 is a certificate validation weakness (CWE-295) in Fleet, the open-source device management and osquery orchestration platform. By default, when Fleet connects to a remote server over SSH, it will automatically trust the presented certificate if that host is not already present in the known_hosts file, rather than rejecting the connection. This insecure default enables a man-in-the-middle (MitM) attacker positioned between Fleet and the target SSH server to impersonate the server and intercept or manipulate the connection. The vulnerability carries a CVSS 3.1 base score of 6.3 (Medium), reflecting a network-reachable, low-complexity attack requiring low privileges with no user interaction.

Technical Analysis

At its core, this is a trust-on-first-use (TOFU) flaw combined with missing certificate/host-key verification, mapped to CWE-295 (Improper Certificate Validation). SSH host key verification is the fundamental mechanism that allows an SSH client to confirm it is communicating with the intended server rather than an impostor. The client maintains a known_hosts file containing previously observed host key fingerprints; on subsequent connections, the server's presented key must match the stored entry or the connection is (normally) refused.

Per the NVD description, Fleet's default behavior breaks this contract:

• If the target server already has a trusted entry in known_hosts, Fleet correctly validates the authenticity of the presented certificate. The verification logic itself is functional.
• If the target server does not have an entry in known_hosts, Fleet automatically trusts whatever certificate/key the remote server presents, establishing the connection without out-of-band verification.

This means the security guarantee depends entirely on the pre-existence of a correct known_hosts entry. Any connection to a host that is not yet pinned — first contact, newly provisioned hosts, ephemeral infrastructure, or hosts whose entries were removed/rotated — is vulnerable to silent acceptance of an attacker-controlled key. Because Fleet is a centralized management platform that orchestrates endpoint agents and executes tasks, an intercepted SSH channel may expose credentials, commands, query results, and configuration pushed through that connection.

The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L indicates the attack is launched over the network, requires no special conditions, needs low-level privileges on the attacker's side (the attacker must be positioned to intercept traffic, e.g., on the network path), and needs no victim interaction. Confidentiality, integrity, and availability impacts are each rated Low, consistent with interception of a single management channel rather than total platform compromise.

It is important to note the limits of the available data: no specific source files, functions, command-line flags, or configuration parameters are named in the provided description beyond the known_hosts file concept. Any deeper code-level reconstruction would be speculative and is deliberately omitted.

Exploitation Scenarios

The following attack chain is inferred from the vulnerability class (improper certificate validation / TOFU acceptance) described in the NVD entry. No public proof-of-concept, exploit code, or Nuclei template is known to exist for CVE-2025-23390; the sequence below is a class-level reconstruction.

1. Reconnaissance / target identification. An attacker with a position on the network path between the Fleet instance and a target SSH server identifies a connection where the destination host is absent from Fleet's known_hosts file. This includes first-time connections, newly added hosts, rotated host keys, or environments where known_hosts is reset. The attacker does not need prior credentials to the Fleet platform — only network positioning (e.g., ARP spoofing, rogue gateway, compromised routing device, or a malicious intermediary node) and low privileges, matching PR:L.

2. Triggering the flawed trust behavior. When Fleet initiates the SSH connection to the un-pinned host, the attacker (acting as MitM) presents their own SSH certificate/host key. Because the destination is not present in known_hosts, Fleet accepts the presented certificate automatically by default instead of aborting the connection. No user interaction is required (UI:N), and the attack completes over the network with low complexity (AC:L).

3. Payload / execution method. At the vulnerability-class level, the attacker now sits between Fleet and the legitimate server, transparently relaying or altering the SSH session. Rather than injecting a novel exploit, the attacker leverages the trusted channel: capturing authentication material, reading commands and task payloads, and optionally modifying data in transit. The exact commands or data exposed depend on what the Fleet-to-server SSH channel carries in a given deployment and are not specified in the available data.

4. Post-exploitation impact. Successful interception yields Low confidentiality, integrity, and availability impact per the CVSS assessment: potential exposure of credentials or sensitive operational data (C:L), the ability to tamper with commands or results flowing over the channel (I:L), and possible disruption of the connection (A:L). The attacker gains a foothold in the management pathway but, per the score, not necessarily full platform control.

If a correct and current entry exists in known_hosts for the destination, the presented certificate is validated and this attack fails — making the flaw strictly a function of unpinned hosts.

Impact Assessment

Fleet is a management and orchestration platform, so a compromised SSH channel carries disproportionate risk relative to a single host: the data traversing it may include credentials, configuration, task definitions, and query output for managed endpoints. The blast radius is bounded by which connections involve un-pinned hosts — typically first-contact, newly provisioned, or key-rotated systems, which are common in dynamic and cloud environments. Organizations that rely on the default behavior without pre-populating or centrally managing known_hosts face the largest exposure.

Mapping to CVSS subscores:

• Confidentiality (C:L) — interception may expose data on the channel, but impact is limited to what that session carries.
• Integrity (I:L) — the attacker can alter relayed content, but the effect is scoped to the tunneled interaction.
• Availability (A:L) — the attacker can disrupt or drop the connection.
• Scope (S:U) — impact remains within the same security authority; no privilege boundary crossing is claimed.
• Attack Vector (AV:N) / Complexity (AC:L) / Privileges (PR:L) / User Interaction (UI:N) — remotely reachable, low complexity, low attacker privilege, no victim action.

CISA KEV status is NO; there is no confirmed in-the-wild exploitation at this time. The absence of public PoC, Nuclei templates, or exploit code lowers near-term opportunistic risk, but the low complexity means a determined, network-positioned adversary could weaponize it without much effort. Because Fleet is frequently deployed in enterprise endpoint-management contexts, even a Low-rated interception can yield valuable intelligence to an attacker.

Detection Guidance

Sigma Rule

title: Possible SSH Host Key Trust Bypass via Fleet (CVE-2025-23390)
id: 7c1f9a2e-3b4d-4e6f-9a01-5c8d2e7f1b44
status: experimental
description: Detects modification or removal of known_hosts entries and SSH connections to unpinned hosts that may indicate exploitation of Fleet's default trust-on-first-use behavior (CWE-295).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-23390
author: valtersit.com Threat Intelligence
date: 2025-01-01
tags:
  - attack.t1557
  - attack.credential_access
logsource:
  category: file_event
  product: linux
detection:
  selection_known_hosts:
    TargetFilename|endswith: 'known_hosts'
    EventType:
      - 'FileDelete'
      - 'FileModify'
  selection_ssh_proc:
    Image|endswith: '/ssh'
    CommandLine|contains:
      - 'StrictHostKeyChecking=no'
      - 'UserKnownHostsFile=/dev/null'
      - 'StrictHostKeyChecking=accept-new'
  condition: selection_known_hosts or selection_ssh_proc
falsepositives:
  - Legitimate provisioning scripts that manage known_hosts
  - Administrative SSH configuration changes
level: medium

YARA Rule

rule CVE_2025_23390_Fleet_KnownHosts_TrustBypass
{
    meta:
        description = "Detects Fleet configurations or scripts that disable SSH host key verification, consistent with CVE-2025-23390 (CWE-295 improper certificate validation)."
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-23390"
        date = "2025-01-01"
        severity = "medium"

    strings:
        $ssh_a = "StrictHostKeyChecking=no" ascii wide nocase
        $ssh_b = "UserKnownHostsFile=/dev/null" ascii wide nocase
        $ssh_c = "StrictHostKeyChecking=accept-new" ascii wide nocase
        $kh    = "known_hosts" ascii wide nocase
        $fleet = "fleet" ascii wide nocase

    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x464C457F or
        (2 of ($ssh_*) and $kh) or
        ($kh and $fleet and 1 of ($ssh_*))
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 22 (msg:"CVE-2025-23390 Possible Fleet SSH Host Key Trust Bypass - SSH Server Key Exchange to Unpinned Host"; flow:established,to_server; content:"|14|"; depth:1; byte_test:1,>,10,0,relative; reference:cve,2025-23390; reference:url,nvd.nist.gov/vuln/detail/CVE-2025-23390; classtype:attempted-recon; sid:2025233901; rev:1; metadata:created_at 2025_01_01, cve CVE_2025_23390;)

Elastic Detection

process where event.type == "start" and process.name in ("ssh", "ssh.exe")
  and process.command_line : (
    "*StrictHostKeyChecking=no*",
    "*StrictHostKeyChecking=accept-new*",
    "*UserKnownHostsFile=/dev/null*"
  )

Splunk SPL Query

index=main (sourcetype=sysmon OR sourcetype=linux_audit OR sourcetype=unix:syslog)
(process_name=ssh OR process_name=sshd OR CommandLine="*ssh*")
(CommandLine="*StrictHostKeyChecking=no*" OR CommandLine="*StrictHostKeyChecking=accept-new*" OR CommandLine="*UserKnownHostsFile=/dev/null*" OR CommandLine="*known_hosts*")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as commands values(dest) as destinations by host user process_name
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="fleet,ssh,cve-2025-23390,">
  <rule id="2023390" level="10">
    <decoded_as>json</decoded_as>
    <field name="command">StrictHostKeyChecking=no</field>
    <description>CVE-2025-23390: SSH host key verification disabled or bypassed (potential Fleet known_hosts TOFU exploitation)</description>
    <mitre>
      <id>T1557</id>
    </mitre>
    <group>credential_access,</group>
  </rule>

  <rule id="2023391" level="10">
    <decoded_as>json</decoded_as>
    <field name="command">UserKnownHostsFile=/dev/null</field>
    <description>CVE-2025-23390: SSH known_hosts file set to /dev/null - host key verification bypassed</description>
    <mitre>
      <id>T1557</id>
    </mitre>
    <group>credential_access,</group>
  </rule>

  <rule id="2023392" level="8">
    <if_sid>550</if_sid>
    <field name="file">known_hosts</field>
    <description>CVE-2025-23390: known_hosts file modified or deleted - possible trust-on-first-use (TOFU) exploitation</description>
    <mitre>
      <id>T1557</id>
    </mitre>
    <group>fleet,ssh,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is rated 2/4 (CLAIMED — a single source, GHSA, claims a patch exists, but this has not been independently confirmed and no specific patched version is provided in the available data). Treat the following as prioritized guidance pending authoritative confirmation from the Fleet project.

1. Immediate mitigations (do not wait for the patch):

   • Pre-populate and centrally manage known_hosts entries for every server Fleet connects to over SSH, so no connection relies on the insecure default. Use configuration management to distribute and pin host keys out-of-band.
   • Where Fleet exposes configuration for SSH host-key verification behavior, set it to require strict validation rather than automatic trust for unpinned hosts. (The specific setting name is not provided in the available data; consult Fleet documentation.)
   • Restrict network paths between the Fleet instance and managed SSH endpoints — segment management traffic, use encrypted tunnels between trusted nodes, and apply anti-spoofing/MitM controls (DHCP snooping, dynamic ARP inspection, 802.1X) at the network layer.
   • Monitor for known_hosts modification/deletion and for SSH invocations using StrictHostKeyChecking=no, StrictHostKeyChecking=accept-new, or UserKnownHostsFile=/dev/null.

2. Patch / upgrade steps:

   • Verify the current Fleet version against the GHSA advisory referenced in the source data and apply the vendor-released fixed version once confirmed. Because the patch is only single-source claimed and no version range is given, validate the advisory directly at the Fleet project's security page before upgrading.
   • After upgrading, re-verify that unpinned hosts are no longer auto-trusted and that host-key validation is enforced by default.

3. Long-term hardening:

   • Adopt centralized SSH certificate authority (CA) based host keys so trust is established cryptographically rather than via per-host TOFU pinning.
   • Bake host-key pinning into provisioning pipelines so known_hosts is authoritative from first contact.
   • Add detection coverage (rules above) for host-key verification bypass and known_hosts tampering as durable controls independent of patching.
   • Track CISA KEV and Fleet advisories for any change in exploitation status.

References

• NVD — CVE-2025-23390: https://nvd.nist.gov/vuln/detail/CVE-2025-23390
• MITRE CWE-295 (Improper Certificate Validation): https://cwe.mitre.org/data/definitions/295.html
• Fleet project GitHub Security Advisories (GHSA): https://github.com/fleetdm/fleet/security/advisories
• MITRE ATT&CK T1557 — Adversary-in-the-Middle: https://attack.mitre.org/techniques/T1557/
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2025-23390 is not currently listed)

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2025-23390 at the time of writing. Only the NVD description and the single-source GHSA patch claim are available; additional technical specifics should be confirmed against the vendor advisory as it is released.