Picus-RedReport-2024
CVE-2023-48795 vulnerability allows adversaries to launch a prefix truncation attack against…
CVE-2023-48795 Public exploit Medium · 5.9 EPSS 93.5%
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows…
Summary
A flaw in the SSH transport protocol when certain OpenSSH extensions are used lets remote attackers bypass integrity checks, causing some security features to be downgraded or disabled (a Terrapin attack). It affects OpenSSH before 9.6 and many other SSH clients, servers, and libraries.
Official description · CVE.org
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust.
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown. Breakdown
70.8 / 100
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 1
- Tactics
- 2/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.How attackers get in
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 14 months after disclosure. Public exploit code (PoC-in-GitHub) appeared 13 months after disclosure.
- Disclosedday 0
- Public exploit codePoC-in-GitHub+13 mo
- First seen exploitedVulnCheck KEV evidence+14 mo
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
1 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order, 1 cited passage 1Credential AccessTA0006
Adversary-in-the-Middle T1557 Medium Confidence (technique links)How sure Patchfirst is that an ATT&CK technique applies to this CVE. High and medium links are shown by default; low ones come from early or generic mappings, text matching, or contradict the CVE’s details. also Collection
AI mapping from the description · how it is exploited
Network MitM manipulating SSH handshake packets
allows remote attackers to bypass integrity checks such that some packets are omitted
Detection
0 rules for this CVE · 10 general rules for its techniquesRules for this CVE
0Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2023-48795 directly.CVE-specific rules are not available in this build. Search SigmaHQ ↗
General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
Adversary-in-the-MiddleT155710 general rules
- Suspicious Child Process of Notepad++ Updater - GUP.Exehighexperimental
- Uncommon File Created by Notepad++ Updater Gup.EXEhighexperimental
- Potential Suspicious Activity Using SeCEditmediumtest
- ISATAP Router Address Was Setmediumexperimental
- Notepad++ Updater DNS Query to Uncommon Domainsmediumexperimental
- Cisco BGP Authentication Failureslowtest
- Cisco LDP Authentication Failureslowtest
- Huawei BGP Authentication Failureslowtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Am I affected? What do I upgrade to?
From GitHub Security Advisories and OSV3 packages in 3 ecosystems. No single main package: each of these ships the affected code.
- Gogolang.org/x/cryptoAffected: All versions before 0.17.0; All versions before 0.0.0-20231218163308-9d2ee975ef9fUpgrade to 0.17.0 or later (older lines: 0.0.0-20231218163308-9d2ee975ef9f)
- PyPIparamikoAffected: 2.5.0 up to 3.4.0Upgrade to 3.4.0 or later
- CargorusshAffected: All versions before 0.40.2Upgrade to 0.40.2 or later
What security researchers reported
Named in 1 threat report1 reportpicussecurity.com
Reports are matched by finding the exact id CVE-2023-48795 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
Also mentioned in 16 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- ACTUALIZACION | Oracle Critical Patch Update Advisory - April 202613 May 2026
- Two Passwords, Two Compromise Stories - and the PhantomStealer v3.5.0 Config30 Apr 2026
- Spam “Broken Seal” DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos22 Mar 2026
- Spam “Broken Seal” DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos22 Mar 2026
- “Broken Seal” DocuSign-themed Delivery with Fileless Process Hollowing (Zeppelin/Bloat-A)13 Feb 2026
- 131.186.60.1231 Oct 2025
- 10 more on OTX