Summary
A Windows-specific authentication flaw in wolfSSHd can leave a previously acquired Windows logon token associated with a later connection. A less privileged user with a valid server account may exploit this token mix-up to authenticate as a more privileged user when password or public key authentication is used.
A Windows-specific authentication flaw in wolfSSHd can leave a previously acquired Windows logon token associated with a later connection. A less privileged user with a valid server account may exploit this token mix-up to authenticate as a more privileged user when password or public key authentication is used.
Affected context
The issue occurs in the Windows port of wolfSSHd when password or public key authentication is enabled and Windows logon tokens are acquired for multiple connections. Non-Windows builds are not affected, and exploitation depends on token state being incorrectly retained between authenticated sessions.
The issue occurs in the Windows port of wolfSSHd when password or public key authentication is enabled and Windows logon tokens are acquired for multiple connections. Non-Windows builds are not affected, and exploitation depends on token state being incorrectly retained between authenticated sessions.
Exploit preconditions
- Attack surface: Windows wolfSSHd authentication handling
- Required access: A valid account with less privilege on the server
- Authentication method: Password or public key authentication
- Trigger point: A subsequent connection that causes another Windows logon token to be acquired
- Why exploitation is possible: The token from an earlier authenticated connection may not be released before the next token is obtained, allowing authentication state to be associated with the wrong user
- Attack surface: Windows wolfSSHd authentication handling
- Required access: A valid account with less privilege on the server
- Authentication method: Password or public key authentication
- Trigger point: A subsequent connection that causes another Windows logon token to be acquired
- Why exploitation is possible: The token from an earlier authenticated connection may not be released before the next token is obtained, allowing authentication state to be associated with the wrong user
Why this happens
The underlying bug is improper authentication-state and credential-token lifecycle management. A Windows logon token acquired for one connection remains available when a later connection requests authentication, creating a cross-connection identity confusion condition. This maps primarily to CWE-287: Improper Authentication and is also related to CWE-613: Insufficient Session Expiration, because security-sensitive session state is not reliably invalidated at the end of its intended lifetime.
The underlying bug is improper authentication-state and credential-token lifecycle management. A Windows logon token acquired for one connection remains available when a later connection requests authentication, creating a cross-connection identity confusion condition. This maps primarily to CWE-287: Improper Authentication and is also related to CWE-613: Insufficient Session Expiration, because security-sensitive session state is not reliably invalidated at the end of its intended lifetime.
Potential impact
- A less privileged account could authenticate as a more privileged user
- Attackers may gain access to resources authorized for another account
- Account-level privilege boundaries could be bypassed
- Administrative actions could be performed under an incorrectly identified identity
- Audit records could attribute activity to the wrong user
- A less privileged account could authenticate as a more privileged user
- Attackers may gain access to resources authorized for another account
- Account-level privilege boundaries could be bypassed
- Administrative actions could be performed under an incorrectly identified identity
- Audit records could attribute activity to the wrong user
General mitigation guidance
Mitigation generally focuses on making authentication state connection-scoped and ensuring that every acquired Windows logon token is released or invalidated before the connection ends or another authentication transaction begins.
Common defensive patterns include:
- Binding each token explicitly to the connection and authenticated identity that created it
- Clearing authentication and session state on disconnect, failure, timeout, and reauthentication
- Preventing token reuse across concurrent or sequential connections
- Applying least privilege to service accounts and Windows process tokens
- Limiting administrative capabilities available through SSH sessions
- Using secure-by-default authentication and session lifecycle policies
- Testing authentication isolation across repeated, concurrent, and failed connections
Mitigation generally focuses on making authentication state connection-scoped and ensuring that every acquired Windows logon token is released or invalidated before the connection ends or another authentication transaction begins.
Common defensive patterns include:
- Binding each token explicitly to the connection and authenticated identity that created it
- Clearing authentication and session state on disconnect, failure, timeout, and reauthentication
- Preventing token reuse across concurrent or sequential connections
- Applying least privilege to service accounts and Windows process tokens
- Limiting administrative capabilities available through SSH sessions
- Using secure-by-default authentication and session lifecycle policies
- Testing authentication isolation across repeated, concurrent, and failed connections
How teams detect issues like this
Detection can include static and dynamic review of authentication-token lifecycle handling, with particular attention to token caching, global or shared session state, and cleanup paths on disconnect and authentication failure. Code review should verify that identity and token objects are scoped to a single connection and cannot be reused by another session.
Runtime testing can monitor repeated logins by accounts with different privilege levels and compare the authenticated identity, Windows token identity, authorization result, and audit record for each connection. Policy enforcement may require connection-isolated credentials, explicit token cleanup, and regression tests for sequential and concurrent authentication flows. Automated code review and security analysis tools may help identify shared authentication state and missing cleanup paths.
Detection can include static and dynamic review of authentication-token lifecycle handling, with particular attention to token caching, global or shared session state, and cleanup paths on disconnect and authentication failure. Code review should verify that identity and token objects are scoped to a single connection and cannot be reused by another session.
Runtime testing can monitor repeated logins by accounts with different privilege levels and compare the authenticated identity, Windows token identity, authorization result, and audit record for each connection. Policy enforcement may require connection-isolated credentials, explicit token cleanup, and regression tests for sequential and concurrent authentication flows. Automated code review and security analysis tools may help identify shared authentication state and missing cleanup paths.
