Listen to this Post
The original CVE-2026-45309 addressed a path traversal in AsyncSSH’s `AuthorizedKeysFile` %u substitution, where an attacker could use `../` sequences to read arbitrary authorized_keys files pre‑authentication. The fix added a guard in `SSHServerConfig._set_tokens` (asyncssh/config.py:715‑716) that rejects usernames containing /, \, or equal to `..` before the `%u` token is expanded. However, this guard only checks the raw username – it does not account for later expansion steps. After `%u` is substituted, the resulting value is passed through environment‑variable expansion (_expand_val, config.py:145‑149) and, when the file is opened, through `expanduser()` (via `open(Path(filename).expanduser())` in misc.py:290). Both of these re‑introduce path control that the guard was meant to block. A username such as `~root` contains no /, \, or .., so it passes the guard. If `AuthorizedKeysFile` starts with `%u` (e.g., %u/.ssh/authorized_keys), the expanded value becomes ~root/.ssh/authorized_keys, and `expanduser()` resolves it to `/root/.ssh/authorized_keys` – redirecting the lookup to a different user’s home directory without using any path separator. Similarly, `${HOME}` passes the guard and is later expanded to an absolute path containing /. This bypass allows an attacker to read an authorized‑keys file outside the intended per‑user location, potentially authenticating as another user if that file contains the attacker’s public key. The attack is pre‑authentication, works on Python 3.13 where `expanduser()` raises `RuntimeError` for nonexistent users (so only existing accounts are reachable), and is deterministic. The vendor has been notified with a ~90‑day disclosure window.
DailyCVE Form:
Platform: AsyncSSH
Version: 2.23.0, a60f863
Vulnerability: Incomplete fix bypass
Severity: High
date: 2026‑05‑29
Prediction: 2026‑08‑27
What Undercode Say:
Reproduction against asyncssh 2.23.0 checkout
cd /path/to/asyncssh
PYTHONPATH=/path/to/asyncssh python3 poc_authkeys_token_bypass.py
Expected output (abridged):
[bash] original CVE '../../../../tmp/evil' blocked: True
literal-slash user '/etc' blocked: True
[bash] tilde bypass user '~root':
guard blocks it? False
expanded config value : ['~root/.ssh/authorized_keys']
after expanduser() : /root/.ssh/authorized_keys
VERDICT: guard is bypassable via ~ and ${ENV} (incomplete fix CONFIRMED)
PoC source (local, deterministic, no network):
!/usr/bin/env python3 ... (full PoC as given in the ) ...
Exploit: (Educational Purposes!)
- Primary vector: Supply username `~root` (or
~victim) when the server’s `AuthorizedKeysFile` begins with%u. The guard allows it, and later `expanduser()` resolves it to the target user’s home directory, causing the server to read that user’s authorized_keys file. If that file contains the attacker’s public key, authentication succeeds as that user. - Secondary vector: Supply `${HOME}` or any existing environment variable that contains
/. The guard passes (no `/` in the username), but environment expansion re‑introduces the/, leading to an absolute path. This is weaker because the attacker cannot control the variable’s value, but it demonstrates the guard’s insufficiency.
Protection: from this CVE
- Tighten `_set_tokens` to also reject usernames containing a leading `~` or
~user, as well as `$` or `${` references. - More robustly, validate the final expanded `AuthorizedKeysFile` path against a safe base directory, or disable `expanduser()` and environment expansion on the
%u‑derived component. - Until a patch is released, avoid using `%u` as the leading component of
AuthorizedKeysFile, or restrict the allowed username characters to alphanumerics and hyphens.
Impact:
- Pre‑authentication path redirection allows reading arbitrary authorized_keys files outside the per‑user directory.
- If an attacker’s public key is present in the redirected file, they can authenticate as that user without knowing their password.
- Confidentiality impact is High (C:N/I:H/A:N); Integrity and Availability are not directly affected.
- Affects AsyncSSH 2.23.0 and current develop (a60f863) on Python 3.13 (and likely earlier versions where `expanduser()` does not raise for nonexistent users).
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
