T09 · Insecure Skill Coding Practices
Error
- Location
scripts/run-all.sh:25- Finding
SSH Host Identity Verification Is Disabled
- Content
View full analysis
&1 ``` `scripts/run.sh:18`: ```bash sshpass -p "$PASS" ssh -o StrictHostKeyChecking=no -o ConnectTimeout=10 "$USER@$VPS" "$COMMAND" 2>&1 ``` `scripts/status.sh:31,35-37`: ```bash elif sshpass -p "$PASS" ssh -o StrictHostKeyChecking=no -o ConnectTimeout=5 "$USER@$VPS" "echo OK" 2>/dev/null | grep -q "OK"; then echo "✅ Online" # Get basic stats UPTIME=$(sshpass -p "$PASS" ssh -o StrictHostKeyChecking=no -o ConnectTimeout=5 "$USER@$VPS" "uptime -p" 2>/dev/null) LOAD=$(sshpass -p "$PASS" ssh -o StrictHostKeyChecking=no -o ConnectTimeout=5 "$USER@$VPS" "cat /proc/loadavg | cut -d' ' -f1-3" 2>/dev/null) PROVIDERS=$(sshpass -p "$PASS" ssh -o StrictHostKeyChecking=no -o ConnectTimeout=5 "$USER@$VPS" "docker ps --filter name=urnetwork --format '{{.Names}}' 2>/dev/null | wc -l" 2>/dev/null) ``` ### Technical Analysis Every SSH invocation explicitly sets `StrictHostKeyChecking=no`. This causes previously unknown SSH host keys to be accepted without administrator verification, undermining SSH's server-authentication guarantee. When a target has no trusted key already recorded, an attacker able to manipulate DNS, routing, ARP, or another relevant network layer can impersonate the VPS. Because password authentication is used, the SSH session terminates at the impersonating server and the supplied password can be captured. The attacker can also provide falsified command results to the operator. The behavior is repeated across all three executable scripts, including every remote health-check request. ### Attack Path 1. An attacker gains a position capable of redirecting traffic intended for ...[truncated 1188 chars]- Remediation
View remediation