{"uuid": "4c806406-8677-45bc-a725-bbf34f283aa0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2018-10933", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssh/libssh_auth_bypass.rb", "content": "{\"actions\": [{\"description\": \"Execute a command\", \"name\": \"Execute\"}, {\"description\": \"Spawn a shell\", \"name\": \"Shell\"}], \"aliases\": [], \"arch\": \"\", \"author\": [\"Peter Winter-Smith\", \"wvu \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits an authentication bypass in libssh server code\\n          where a USERAUTH_SUCCESS message is sent in place of the expected\\n          USERAUTH_REQUEST message. libssh versions 0.6.0 through 0.7.5 and\\n          0.8.0 through 0.8.3 are vulnerable.\\n\\n          Note that this module's success depends on whether the server code\\n          can trigger the correct (shell/exec) callbacks despite only the state\\n          machine's authenticated state being set.\\n\\n          Therefore, you may or may not get a shell if the server requires\\n          additional code paths to be followed.\", \"disclosure_date\": \"2018-10-16\", \"fullname\": \"auxiliary/scanner/ssh/libssh_auth_bypass\", \"is_install_path\": true, \"mod_time\": \"2026-04-15 11:57:01 +0000\", \"name\": \"libssh Authentication Bypass Scanner\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/auxiliary/scanner/ssh/libssh_auth_bypass.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"scanner/ssh/libssh_auth_bypass\", \"references\": [\"CVE-2018-10933\", \"URL-https://www.libssh.org/security/advisories/CVE-2018-10933.txt\", \"ATT&CK-T1021.004\"], \"rport\": 22, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:48:07.908299Z"}