Security Review & Threat Model: CVE-2024-3094 (xz-utils / OpenSSH)

This repository contains the results of analyzing the critical vulnerability CVE-2024-3094 (backdoor in the liblzma library of the xz-utils package, leading to RCE via the OpenSSH process).

As part of the project, an isolated test environment was prepared, a threat model was developed, and automated checks were written.

📂 Project Structure

• Dockerfile — Build script for the environment (Debian Bookworm) with all dependencies (OpenSSH, Python 3, venv, pytest, pwntools).
• tests/ — Directory with automated tests (pytest):
  • test_vulnerability.py / tests_vulnerability.py — integration tests for SSH functionality and Mock tests to verify the behavior of the backdoor detection system.
• exploit/ — Proof of Concept (PoC) scripts for attack emulation.
• docs/ — Threat Model in Markdown format and graphs.
• reports/ — Reports on static/dynamic analysis results.

🛠 Environment Setup and Launch

All tests and research are conducted in an isolated Docker container to avoid exposing the host system.

1. Build Docker Image

The image installs an SSH server (with password root:screencast) and sets up a Python virtual environment with all necessary libraries.

docker build -t cveanalysis:20243094 .

2. Run the Container

The container runs in the background. The internal SSH port (22) is mapped to port 2222 on the host machine.

docker run -d -p 2222:22 --name cve-test cveanalysis:20243094

🧪 Run Automated Tests (Pytest)

To run all test files (test_vulnerability.py and tests_vulnerability.py), execute the command from your host machine:

docker exec -it cve-test pytest -v tests/*

What the tests check:

• [CVE] Successful detection of timing anomalies (delay >0.5s) characteristic of the backdoor (implemented via Mock pattern).
• [CVE] Verification of no anomalies on the "clean" (patched) SSH server in the container.
• [Regression] Correct password authentication (root:screencast).
• [Regression] Access denial with incorrect password.
• [Regression] Speed of establishing a legitimate SSH connection.

💥 Run Proof of Concept (PoC)

If you want to test scripts from the exploit/ folder (or connect via SSH manually) from your host machine, use the forwarded port 2222:

# Example manual login
ssh [email protected] -p 2222
# Password: screencast

# Example running your PoC script (if it requires external execution)
python3 exploit/PoC.py 127.0.0.1

🛑 Stop and Clean Up

After completing the analysis, stop and remove the test container:

docker stop cve-test
docker rm cve-test