Missing Authorization in sshportal Exposes SSH Private Keys

Executive Summary

sshportal through version 1.19.5 has a missing authorization vulnerability in the 'key show' command of its management shell. This flaw allows authenticated non-admin users to retrieve decrypted backend private SSH keys by requesting predictable key names like 'default' or 'host'. Attackers can then use these keys to directly connect to backend hosts, bypassing access controls and session recording.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized access to the management shell and execution of the 'key show' command by non-admin users. Monitor logs for commands like 'key show default' or 'key show host' which may indicate exploitation attempts.

Useful 0 Not Useful 0

Impact Analysis

If you are a non-admin user of sshportal, an attacker could exploit this to obtain private SSH keys and gain unauthorized access to backend systems. If you are an admin or system owner, this could lead to unauthorized lateral movement within your network, data breaches, or loss of sensitive information. The impact depends on key reuse across hosts.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements such as GDPR (data protection) or HIPAA (health information privacy). It undermines access controls and session recording, which are critical for audit trails and regulatory compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade sshportal to a version that includes the admin role check for the 'key show' command. Restrict management shell access to admin users only. Rotate all exposed private SSH keys immediately.

Useful 0 Not Useful 0