|
| 1 | +# Gitblit Embedded SSH Auth Bypass (CVE-2024-28080) |
| 2 | + |
| 3 | +{{#include ../../banners/hacktricks-training.md}} |
| 4 | + |
| 5 | +## Summary |
| 6 | + |
| 7 | +CVE-2024-28080 is an authentication bypass in Gitblit’s embedded SSH service due to incorrect session state handling when integrating with Apache MINA SSHD. If a user account has at least one SSH public key registered, an attacker who knows the username and any of that user’s public keys can authenticate without the private key and without the password. |
| 8 | + |
| 9 | +- Affected: Gitblit < 1.10.0 (observed on 1.9.3) |
| 10 | +- Fixed: 1.10.0 |
| 11 | +- Requirements to exploit: |
| 12 | + - Git over SSH enabled on the instance |
| 13 | + - Victim account has at least one SSH public key registered in Gitblit |
| 14 | + - Attacker knows victim username and one of their public keys (often discoverable, e.g., https://github.com/<username>.keys) |
| 15 | + |
| 16 | +## Root cause (state leaks between SSH methods) |
| 17 | + |
| 18 | +In RFC 4252, public‑key authentication proceeds in two phases: the server first checks whether a provided public key is acceptable for a username, and only after a challenge/response with a signature does it authenticate the user. In MINA SSHD, the PublickeyAuthenticator is invoked twice: on key acceptance (no signature yet) and later after the client returns a signature. |
| 19 | + |
| 20 | +Gitblit’s PublickeyAuthenticator mutated the session context on the first, pre‑signature call by binding the authenticated UserModel to the session and returning true ("key acceptable"). When authentication later fell back to password, the PasswordAuthenticator trusted that mutated session state and short‑circuited, returning true without validating the password. As a result, any password (including empty) was accepted after a prior public‑key "acceptance" for the same user. |
| 21 | + |
| 22 | +High‑level flawed flow: |
| 23 | + |
| 24 | +1) Client offers username + public key (no signature yet) |
| 25 | +2) Server recognizes the key as belonging to the user and prematurely attaches user to the session, returns true ("acceptable") |
| 26 | +3) Client cannot sign (no private key), so auth falls back to password |
| 27 | +4) Password auth sees a user already present in session and unconditionally returns success |
| 28 | + |
| 29 | +## Step‑by‑step exploitation |
| 30 | + |
| 31 | +- Collect a victim’s username and one of their public keys: |
| 32 | + - GitHub exposes public keys at https://github.com/<username>.keys |
| 33 | + - Public servers often expose authorized_keys |
| 34 | +- Configure OpenSSH to present only the public half so signature generation fails, forcing a fallback to password while still triggering the public‑key acceptance path on the server. |
| 35 | + |
| 36 | +Example SSH client config (no private key available): |
| 37 | + |
| 38 | +```sshconfig |
| 39 | +# ~/.ssh/config |
| 40 | +Host gitblit-target |
| 41 | + HostName <host-or-ip> |
| 42 | + User <victim-username> |
| 43 | + PubkeyAuthentication yes |
| 44 | + PreferredAuthentications publickey,password |
| 45 | + IdentitiesOnly yes |
| 46 | + IdentityFile ~/.ssh/victim.pub # public half only (no private key present) |
| 47 | +``` |
| 48 | + |
| 49 | +Connect and press Enter at the password prompt (or type any string): |
| 50 | + |
| 51 | +```bash |
| 52 | +ssh gitblit-target |
| 53 | +# or Git over SSH |
| 54 | +GIT_SSH_COMMAND="ssh -F ~/.ssh/config" git ls-remote ssh://<victim-username>@<host>/<repo.git> |
| 55 | +``` |
| 56 | + |
| 57 | +Authentication succeeds because the earlier public‑key phase mutated the session to an authenticated user, and password auth incorrectly trusts that state. |
| 58 | + |
| 59 | +Note: If ControlMaster multiplexing is enabled in your SSH config, subsequent Git commands may reuse the authenticated connection, increasing impact. |
| 60 | + |
| 61 | +## Impact |
| 62 | + |
| 63 | +- Full impersonation of any Gitblit user with at least one registered SSH public key |
| 64 | +- Read/write access to repositories per victim’s permissions (source exfiltration, unauthorized pushes, supply‑chain risks) |
| 65 | +- Potential administrative impact if targeting an admin user |
| 66 | +- Pure network exploit; no brute force or private key required |
| 67 | + |
| 68 | +## Detection ideas |
| 69 | + |
| 70 | +- Review SSH logs for sequences where a publickey attempt is followed by a successful password authentication with an empty or very short password |
| 71 | +- Look for flows: publickey method offering unsupported/mismatched key material followed by immediate password success for the same username |
| 72 | + |
| 73 | +## Mitigations |
| 74 | + |
| 75 | +- Upgrade to Gitblit v1.10.0+ |
| 76 | +- Until upgraded: |
| 77 | + - Disable Git over SSH on Gitblit, or |
| 78 | + - Restrict network access to the SSH service, and |
| 79 | + - Monitor for suspicious patterns described above |
| 80 | +- Rotate affected user credentials if compromise is suspected |
| 81 | + |
| 82 | +## General: abusing SSH auth method state‑leakage (MINA/OpenSSH‑based services) |
| 83 | + |
| 84 | +Pattern: If a server’s public‑key authenticator mutates user/session state during the pre‑signature "key acceptable" phase and other authenticators (e.g., password) trust that state, you can bypass authentication by: |
| 85 | + |
| 86 | +- Presenting a legitimate public key for the target user (no private key) |
| 87 | +- Forcing the client to fail signing so the server falls back to password |
| 88 | +- Supplying any password while the password authenticator short‑circuits on leaked state |
| 89 | + |
| 90 | +Practical tips: |
| 91 | + |
| 92 | +- Public key harvesting at scale: pull public keys from common sources such as https://github.com/<username>.keys, organizational directories, team pages, leaked authorized_keys |
| 93 | +- Forcing signature failure (client‑side): point IdentityFile to only the .pub, set IdentitiesOnly yes, keep PreferredAuthentications to include publickey then password |
| 94 | +- MINA SSHD integration pitfalls: |
| 95 | + - PublickeyAuthenticator.authenticate(...) must not attach user/session state until the post‑signature verification path confirms the signature |
| 96 | + - PasswordAuthenticator.authenticate(...) must not infer success from any state mutated during a prior, incomplete authentication method |
| 97 | + |
| 98 | +Related protocol/design notes and literature: |
| 99 | +- SSH userauth protocol: RFC 4252 (publickey method is a two‑stage process) |
| 100 | +- Historical discussions on early acceptance oracles and auth races, e.g., CVE‑2016‑20012 disputes around OpenSSH behavior |
| 101 | + |
| 102 | +## References |
| 103 | + |
| 104 | +- [Gitblit CVE-2024-28080: SSH public‑key fallback to password authentication bypass (Silent Signal blog)](https://blog.silentsignal.eu/2025/06/14/gitblit-cve-CVE-2024-28080/) |
| 105 | +- [Gitblit v1.10.0 release notes](https://github.com/gitblit-org/gitblit/releases/tag/v1.10.0) |
| 106 | +- [Apache MINA SSHD project](https://mina.apache.org/sshd-project/) |
| 107 | +- [PublickeyAuthenticator API](https://svn.apache.org/repos/infra/websites/production/mina/content/sshd-project/apidocs/org/apache/sshd/server/auth/pubkey/PublickeyAuthenticator.html) |
| 108 | +- [RFC 4252: The Secure Shell (SSH) Authentication Protocol](https://datatracker.ietf.org/doc/html/rfc4252) |
| 109 | + |
| 110 | + |
| 111 | +{{#include ../../banners/hacktricks-training.md}} |
0 commit comments