A vulnerability (CVE-2025-32433) has been identified in the ssh library, which is part of the Erlang/OTP toolkit, enabling the execution of one's code on an SSH server created with the vulnerable library, without passing authentication. The issue has been assigned a critical severity level (10 out of 10).
One security researcher has already prepared a working exploit to execute code on vulnerable SSH servers. Notably, according to the researcher, the code was created using AI assistants GPT-4, Cursor, and Sonnet based on the analysis of changes with the vulnerability fix, including a test to verify the remediation of the issue.
The library from the Erlang/OTP project provides ready-made client implementations of serwera SSH and SFTP, supporting the SSH 2.0 protocol. Problematic SSH servers can be identified by the header output "SSH-2.0-Erlang/version." SSH servers based on Erlang/OTP are used in specialized systems, such as IoT and edge computing devices, as well as a debugging tool—Erlang allows you to easily enable an SSH server for remote debugging of one's applications (it is assumed that such debugging capability could have been left enabled in many projects written in Erlang). The issue is also present in the Elixir toolkit (implemented on top of Erlang) and in the Phoenix framework based on it, but the SSH server in Phoenix does not by default accept requests from external networks.
The vulnerability is caused by an error in the message parsing code, which improperly handled SSH_MSG_CHANNEL_REQUEST messages allowing execution of the "exec" command at the authentication phase. Here is an example of code from the exploit: command = ‘file:write_file("/lab.txt", <>).’ return ( b"\x62" # SSH_MSG_CHANNEL_REQUEST + struct.pack(">I", channel_id) + string_payload("exec") + b"\x01" # want_reply = true + string_payload(command) )
The vulnerability has been fixed in releases Erlang/OTP-27.3.3, 26.2.5.11, and 25.3.2.20. The remediation of the vulnerability in the distributions can be tracked on the following pages: Debian, Ubuntu, Fedora, SUSE/openSUSE, RHEL, Arch, FreeBSD.
Źródło: opennet.ru
