CVE-2024-39223: 
gost vulnerability analysis and mitigation

An authentication bypass vulnerability exists in the SSH service of gost v2.11.5, identified as CVE-2024-39223. The vulnerability was discovered in July 2024 and allows attackers to intercept communications by exploiting the HostKeyCallback function set to ssh.InsecureIgnoreHostKey. This affects the SSH service implementation in gost version 2.11.5 and earlier versions (GitHub Issue).

The vulnerability exists in the SSH ForwardTransporter handshake process, specifically in the file github.com/ginuerzh/gost/ssh.go at line 229. The issue stems from a critical configuration that bypasses host key verification by setting HostKeyCallback to ssh.InsecureIgnoreHostKey(). This configuration effectively disables host key verification during SSH connection establishment, allowing any server's host key to be accepted without validation (GitHub Code). The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability significantly weakens the security of SSH connections managed by gost. When exploited, it allows attackers to perform Man-in-the-Middle (MitM) attacks by intercepting SSH connections and presenting forged host keys. This can lead to unauthorized access to systems, theft of sensitive data, and execution of malicious actions on behalf of legitimate users (GitHub Issue).

The vulnerability is highly exploitable as it requires no special privileges or user interaction. An attacker can exploit this vulnerability by intercepting SSH connections between the client and server, taking advantage of the disabled host key verification to perform MitM attacks (GitHub POC).

The recommended mitigation is to implement a secure host key verification mechanism. This can be achieved by using a known host key or implementing a system for storing and comparing fingerprints against a list of trusted keys. The HostKeyCallback should be updated to use a callback function that properly verifies host keys against a list of known or trusted keys (GitHub Issue).