PowerShell / PowerShell/Win32-OpenSSH
Hardcoded banner allows an attacker to quickly identify vulnerable machines
Open
@vthiebaut10 is already working on this.
Since Apr 17, 2023.
Area-sshd
Investigate
Issue-Bug
- Dominant language
- No language data
- Stars
- 8.3k
- Forks
- 819
- PR merge metrics
- No merged PRs in 30d
Description
Prerequisites
- Write a descriptive title.
- Make sure you are able to repro it on the latest version
- Search the existing issues.
Steps to reproduce
This is a duplicate of https://github.com/PowerShell/Win32-OpenSSH/issues/2021
Win32-OpenSSH publicly displays a banner revealing the OS and the OpenSSH version number. Although this is not a security vulnerability by itself, it will easily give an attacker known vulnerabilities on the system if a version is not the latest.
banner none is ignored in the config.
Expected behavior
No banner shown if `banner none` is in the config
Actual behavior
Displayed banner:
`SSH-2.0-OpenSSH_for_Windows_9.2`
Error details
No response
Environment data
Name Value
---- -----
PSVersion 7.3.4
PSEdition Core
GitCommitId 7.3.4
OS Microsoft Windows 10.0.19045
Platform Win32NT
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
WSManStackVersion 3.0
Version
9.2
Visuals

Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.