Path Traversal in AsyncSSH Prior to 2.23.0

Executive Summary

AsyncSSH before 2.23.0 has a path traversal flaw in the AuthorizedKeysFile %u token expansion. When a server uses a config like AuthorizedKeysFile authorized_keys/%u, AsyncSSH expands %u with the raw SSH username without sanitizing path segments. If the username contains /, \, or .., an attacker can traverse outside the intended authorized_keys directory and authenticate using an attacker-controlled public key file.

Useful 0 Not Useful 0

Detection Guidance

Check AsyncSSH version with pip show asyncssh. If version is below 2.23.0, the system is vulnerable. Inspect SSH server configuration files for AuthorizedKeysFile patterns containing %u. Test with usernames containing path traversal characters like ../ or ..\ to see if files outside intended directories are accessed.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain unauthorized access to an SSH server by providing a malicious username that includes path traversal sequences. This allows them to read or write files outside the authorized_keys directory, potentially executing arbitrary code or escalating privileges if the server uses the vulnerable configuration pattern.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. If exploited, it may result in data breaches, non-compliance with access control and audit logging mandates, and potential regulatory penalties due to compromised personal or health information.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade AsyncSSH to version 2.23.0 or later immediately. Disable or restrict AuthorizedKeysFile configurations using %u token. Review and remove any writable or accessible directories that could be targeted by path traversal. Monitor for unauthorized access attempts or unusual file access patterns in SSH logs.

Useful 0 Not Useful 0