Devices utilizing specific configurations of Alpine Linux, as well as potentially other Linux distributions, are vulnerable to an exploit that could permit attackers to access devices without needing a password. This longstanding vulnerability is rooted in the interaction between OpenSSH—the SSH connection code library—and musl, a lightweight alternative to the standard libc library commonly used in Alpine. It is crucial that OpenSSH employing musl is not configured to use PAM (Pluggable Authentication Modules), which governs user authentication and account access.
The Alpine Linux distribution is recognized for its lightweight nature and widespread application. Other Linux systems might similarly be at risk if they adopt the same configurations. For this vulnerability to be exploited successfully, two critical conditions must be satisfied. Firstly, there must be at least one user account on the targeted system that uses a password hashed with SHA256 or SHA512 algorithms. Secondly, the account must be organized to allow passwordless access, typically denoted by an asterisk (*) in the password field of the /etc/shadow file, where password hashes are stored. Such passwordless accounts are frequently employed for authentication via certificates and are common in specific types of user accounts.
The ramifications of fulfilling these conditions are significant. According to Alpine’s maintainers, an attacker who gains access to the SSH port can log in without any knowledge of the account’s password, with the process requiring just a single connection, functioning consistently without needing retries. Furthermore, if an attacker attempts to log into a passwordless account, they can gain entry by entering more than 256 characters in the password field.
Security firm Checkpoint emphasized the importance of utilizing SHA256 or SHA512 functions, noting that the SSH daemon relies on the account’s salt. If the proper conditions are not met, the attack fails altogether. Their analysis indicated that the targeted account must be active—not merely exist with a hash. They further assessed that root accounts are protected under the standard setting of PermitRootLogin prohibit-password, but reachable accounts with elevated rights provided by doas or sudo could still enable access to the root account.
Given the nature of this vulnerability, organizations employing Alpine Linux or similar configurations are urged to assess their security posture. This incident suggests a possible exploitation technique aligning with the MITRE ATT&CK framework, particularly under the tactics of initial access and privilege escalation. Adversaries may exploit weaknesses in authentication processes, thereby gaining unauthorized entry and potentially escalating their privileges within the system. This serves as a reminder for business owners to remain vigilant about their cybersecurity measures and to ensure that their systems are configured to mitigate such vulnerabilities effectively.