Erlang-OTP-SSH-CVE-2025-32433

✅ Result

The server responded to an SSH message ID 80 (0x50) — which is reserved for post-auth. This proves the server accepts invalid messages during the pre-auth phase, indicating vulnerable behavior as defined in CVE-2025-32433.

---

📖 Research Summary

I built this lab after studying Erlang/OTP and the CVE from various trusted sources.

Erlang/OTP is a powerful environment originally developed by Ericsson to build scalable and fault-tolerant distributed systems. It includes its own SSH server implementation. The SSH module inside Erlang/OTP is vulnerable to unauthenticated remote code execution (RCE) due to incorrect handling of SSH message types ≥ 80 during the pre-auth phase.

Instead of rejecting these invalid messages, the server processes them — which allows an attacker to craft malicious messages and potentially gain unauthorized code execution access.

---

🔍 Key Things I Learned

• Erlang/OTP SSH allows secure shell/file access within Erlang systems
• Message ID 80+ is reserved for post-authentication but can be abused pre-auth
• Detection: Suricata or NIDS can spot “SSH_MSG_CHANNEL_REQUEST” with “exec” commands
• Affected Versions:
  • OTP-27.3.2 and below
  • OTP-26.2.5.10 and below
  • OTP-25.3.2.19 and below
• Patched Versions: