SSH host key verification disabled in paramiko runner (CWE-295)

Summary

Static analysis (Snyk SAST) identified that the paramiko SSH runner disables SSH host key verification by using AutoAddPolicy, which accepts any host key without validation. This makes connections susceptible to man-in-the-middle attacks.

Affected File

st2common/st2common/runners/paramiko_ssh.py (line 782)

client = paramiko.SSHClient()
# FIXME: Allow the admin or end user control the host key policy
client.set_missing_host_key_policy(paramiko.AutoAddPolicy())  # nosec

The existing FIXME comment and # nosec annotation indicate this was a known issue that was intentionally suppressed rather than addressed.

Impact

Any SSH connection made through the StackStorm paramiko runner will accept unknown host keys without verification. An attacker in a network position to intercept SSH traffic could perform a man-in-the-middle attack, potentially capturing credentials or modifying command output.

This is relevant in datacenter and network automation contexts where StackStorm is used to manage infrastructure devices over SSH.

Recommended Fix

• Make the host key policy configurable via st2.conf, as the existing FIXME suggests.
• Default to RejectPolicy or WarningPolicy and allow administrators to opt in to AutoAddPolicy for specific use cases.
• Support loading known hosts from a configurable file path (e.g., ~/.ssh/known_hosts or a custom path).

Example:

policy_name = cfg.CONF.ssh_runner.host_key_policy  # "reject", "warning", "auto_add"
policies = {
    "reject": paramiko.RejectPolicy,
    "warning": paramiko.WarningPolicy,
    "auto_add": paramiko.AutoAddPolicy,
}
client.set_missing_host_key_policy(policies.get(policy_name, paramiko.RejectPolicy)())

known_hosts = cfg.CONF.ssh_runner.known_hosts_file
if known_hosts:
    client.load_host_keys(known_hosts)

References

• CWE-295: Improper Certificate Validation
• Detected by: Snyk Code (SAST)

Start in st2common/st2common/runners/paramiko_ssh.py around line 782 and trace how the paramiko SSH client and st2.conf settings are configured. Define the configurable host-key policy and known-hosts path, with secure verification as the default. Confirm the runner no longer unconditionally uses AutoAddPolicy and verify the affected SSH connection paths.