WolfSSL
/
wolfssh
mirror of https://github.com/wolfSSL/wolfssh.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Userauth none bypasses wolfSSHd credential check 

When wolfsshd is built with WOLFSSH_ALLOW_USERAUTH_NONE, the
DefaultUserAuth() function accepted WOLFSSH_USERAUTH_NONE as a valid
auth type and forwarded it to RequestAuthentication(). Since
RequestAuthentication() only gates credential checks on PASSWORD and
PUBLICKEY types, a none request for any existing system user returned
success without verifying any credential. Removed USERAUTH_NONE as an
accepted auth type in DefaultUserAuth() so it is treated as an invalid
auth type for wolfsshd.

Affected function: DefaultUserAuth.
Issue: F-3215
pull/944/head
John Safranek 2026-04-20 16:51:26 -07:00 committed by Paul Adelsbach
parent 2568b26b84
commit 87c0b05d72
1 changed files with 11 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
apps/wolfsshd/auth.c
View File

@ -1078,8 +1078,11 @@ static int DoCheckUser(const char* usr, WOLFSSHD_AUTH* auth)
}
/* @TODO this will take in a pipe or equivalent to talk to a privileged thread
* rather than having WOLFSSHD_AUTH directly with privilege separation */
/*
* @TODO this will take a pipe or equivalent to talk to a privileged thread
* rather than having WOLFSSHD_AUTH directly with privilege separation.
* Note: authData->type of WOLFSSH_USERAUTH_NONE is not valid for wolfsshd.
*/
static int RequestAuthentication(WS_UserAuthData* authData,
WOLFSSHD_AUTH* authCtx)
{
@ -1091,6 +1094,12 @@ static int RequestAuthentication(WS_UserAuthData* authData,
return WOLFSSH_USERAUTH_FAILURE;
}
if (authData->type == WOLFSSH_USERAUTH_NONE) {
wolfSSH_Log(WS_LOG_ERROR,
"[SSHD] Auth type NONE invalid.");
return WOLFSSH_USERAUTH_INVALID_AUTHTYPE;
}
usr = (const char*)authData->username;
ret = DoCheckUser(usr, authCtx);
/* temporarily elevate permissions */
@ -1291,9 +1300,6 @@ int DefaultUserAuth(byte authType, WS_UserAuthData* authData, void* ctx)
}
if (authType != WOLFSSH_USERAUTH_PASSWORD &&
#ifdef WOLFSSH_ALLOW_USERAUTH_NONE
authType != WOLFSSH_USERAUTH_NONE &&
#endif
authType != WOLFSSH_USERAUTH_PUBLICKEY) {
ret = WOLFSSH_USERAUTH_INVALID_AUTHTYPE;