Path Traversal in AsyncSSH SCP Client

Executive Summary

This vulnerability exists in the AsyncSSH Python package, which implements the SSHv2 protocol asynchronously. Before version 2.23.1, a malicious SSH server could exploit the SCP client by sending filenames containing directory traversal sequences (../). The client’s _parse_cd_args function returns these server-provided filenames without validation, and _recv_files joins them to the destination path without enforcing directory boundaries. This allows the server to write arbitrary files anywhere on the client’s filesystem.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts because it allows a malicious SSH server to write arbitrary files on the client’s filesystem. This can lead to unauthorized modification or creation of files, potentially resulting in data corruption, system compromise, or execution of malicious code. The CVSS score of 8.1 indicates a high severity with impacts on integrity and availability.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade AsyncSSH to version 2.23.1 or later, where the issue has been fixed.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows a malicious SSH server to write arbitrary files on the asyncssh SCP client's filesystem by exploiting path traversal sequences. This can lead to overwriting sensitive files such as ~/.bashrc, ~/.profile, ~/.ssh/rc, or ~/.ssh/authorized_keys, potentially enabling remote code execution.

Such unauthorized file writes and potential remote code execution can compromise the confidentiality and integrity of data on the affected systems, which may violate data protection requirements under standards like GDPR and HIPAA.

Specifically, the ability to overwrite sensitive configuration or authorization files could lead to unauthorized access or data breaches, impacting compliance with regulations that mandate strict controls over personal and sensitive information.

Therefore, this vulnerability poses a significant risk to compliance with common security standards and regulations by undermining system security and data protection controls.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a malicious SSH server sending specially crafted filenames containing directory traversal sequences (../) during SCP file transfers to write arbitrary files on the client's filesystem.

To detect exploitation attempts on your system or network, you can monitor SCP client logs or network traffic for SCP file transfer requests containing suspicious filenames with ../ sequences.

Since the vulnerability is in the asyncssh SCP client prior to version 2.23.1, checking the version of asyncssh installed on your system is a primary step.

• Check asyncssh version: `python -c "import asyncssh; print(asyncssh.__version__)"`
• Monitor SCP traffic for filenames containing '../' sequences using network packet capture tools like tcpdump or Wireshark, for example: `tcpdump -A -s 0 port 22` and filter for SCP file transfer commands.
• Inspect SCP client logs for any errors or unusual file paths that include directory traversal patterns.

Note that no specific detection commands or signatures are provided in the available resources, so detection relies on version checking and monitoring for suspicious SCP file transfer behavior.

Useful 0 Not Useful 0