T09 · Insecure Skill Coding Practices
Error
- Location
index.js:36- Finding
SSH Host Authentication Is Disabled for Remote Node Operations
- Content
View full analysis
/root/.openclaw/logs/evolver.log 2>&1 &"`; ``` ```javascript const cmd = `ssh -i ${node.sshKey} -o StrictHostKeyChecking=no root@${node.ip} "pkill -f 'node index.js'"`; ``` ```javascript let r = await exec(`ssh -i ~/.ssh/id_ed25519_central_to -o StrictHostKeyChecking=no root@43.163.225.27 "ps aux | grep 'node index.js' | grep -v grep"`); r = await exec(`ssh -i ~/.ssh/id_ed25519_tokyo -o StrictHostKeyChecking=no root@43.167.192.145 "ps aux | grep 'node index.js' | grep -v grep"`); ``` ### Technical Analysis The `StrictHostKeyChecking=no` option disables meaningful SSH server identity verification. The client will accept a previously unknown host key without requiring the operator to verify that it belongs to the intended server. This behavior is not necessary for the declared node-management functionality. Secure SSH automation can use pre-provisioned and pinned host keys. Because all start, stop, and remote status operations use this option, the weakness affects every remote management action. The code does not write SSH private-key files. Instead, the `-i` option causes the local SSH client to read the configured private key. Nevertheless, disabling host authentication exposes the resulting privileged connection to server impersonation. ### Attack Path 1. An attacker gains a network position capable of intercepting, redirecting, or rerouting traffic intended for one of the hard-coded server IP addresses. 2. The attacker presents an arbitrary SSH server host key. 3. Because the command uses `StrictHostKeyCh ...[truncated 1077 chars]- Remediation
View remediation