Missing Host Key Verification in FFmpeg libssh SFTP

Executive Summary

FFmpeg through version 9.0.2 has a missing SSH host key verification vulnerability in its libssh-based SFTP protocol handler. This allows attackers to impersonate SFTP servers using man-in-the-middle, DNS, or ARP spoofing. The flaw enables capturing passwords from SFTP URLs, serving malicious media, or intercepting uploaded data.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the FFmpeg version installed on your system. Run: ffmpeg -version. If the version is 9.0.2 or earlier, the system is vulnerable. Additionally, monitor network traffic for suspicious SFTP connections or man-in-the-middle attempts.

Useful 0 Not Useful 0

Impact Analysis

An attacker exploiting this could steal credentials entered in SFTP URLs, replace legitimate media files with malicious ones, or intercept sensitive data being uploaded. This could lead to unauthorized access, data breaches, or malware distribution through forged files.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations using vulnerable FFmpeg versions may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update FFmpeg to a version later than 9.0.2. Disable SFTP protocol usage if not required. Implement network monitoring to detect spoofing attempts. Ensure SSH host key verification is enforced in all SFTP connections.

Useful 0 Not Useful 0