hierynomus / hierynomus/sshj

PasswordUtils blanks out the password causing the AuthKeyboardInteractive to always fail

Open
#677 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
2.7k
Forks
620
Avg merge
3d 23h
Merged PRs (30d)
11

Description

The `authPassword` method takes the same instance of the `PasswordFinder` into both `AuthMethod`. If for some reason the first `AuthMethod` fails (`password` method in this case, e.g. not an accepted method on the host) and it then attempts to authenticate via the `keyboard-interactive` method, the password would have been cleared out after it was retrieved on the first attempt causing the second attempt to always fail.

My current workaround is to create both `AuthMethod` with separate instances of `PasswordFinder` with the same password and that works for me, but I'm assuming the password is being cleared for security reasons? Creating 2 instances of the password and potentially only using the first once will leave the second instance potentially exploitable. Not sure how you would like to address this issue.

https://github.com/hierynomus/sshj/blob/45b2f32b148e06201a028b9480a98249b6c3b446/src/main/java/net/schmizz/sshj/SSHClient.java#L286-L289

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.