Exploitation Summary
EIP tracks 3 public exploits for CVE-2018-7750. PoCs published by Adam Brown, jm33-m0, tlavi00.
AI-analyzed exploit summary This PoC exploits an authentication bypass vulnerability in Paramiko by skipping the authentication step and directly opening an SFTP channel to list the root directory. It demonstrates the flaw where Paramiko fails to enforce authentication before allowing channel operations.
Description
transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step.
Exploits (3)
This PoC exploits an authentication bypass vulnerability in Paramiko by skipping the authentication step and directly opening an SFTP channel to list the root directory. It demonstrates the flaw where Paramiko fails to enforce authentication before allowing channel operations.
This repository contains a working PoC for CVE-2018-7750, a remote code execution vulnerability in Paramiko SSH server versions prior to 2.4.1. The exploit leverages a flaw in the command execution handling of the SSH server, allowing arbitrary command execution.
This PoC exploits an authentication bypass vulnerability in Paramiko (CVE-2018-7750) by skipping the authentication step and directly opening an SFTP channel to list the root directory. It demonstrates the flaw where Paramiko fails to enforce authentication before allowing channel operations.
References (18)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H