T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:63- Finding
SSH Host-Key Verification Is Disabled
- Content
View full analysis
-o StrictHostKeyChecking=no -o ConnectTimeout=10 @ "echo connected && hostname" ``` ### Technical Analysis The documented SSH command disables host-key verification with `StrictHostKeyChecking=no`. SSH host keys authenticate the remote server and protect the client against machine impersonation. Disabling this check causes the client to accept an unverified key without requiring the user to compare it against a trusted fingerprint. The supplied private key is used locally and is not transmitted to the server. Nevertheless, an attacker who can redirect or intercept the network connection can make the agent connect to an attacker-controlled SSH endpoint. Any subsequent commands intended for the legitimate host could then run on the attacker's machine. ### Attack Path 1. The user or agent runs the documented SSH command. 2. An attacker capable of DNS, routing, gateway, or network interception redirects the connection. 3. The attacker presents an arbitrary SSH host key. 4. Because strict checking is disabled, the client accepts the untrusted host without warning or confirmation. 5. The SSH authentication attempt and remote command are directed to the attacker-controlled endpoint. 6. If the same insecure option is reused for later administrative operations, commands or data intended for the Oracle instance may be exposed to the attacker. ### Impact Assessment Successful exploitation permits remote-host impersonation and may expose commands, command output, host metadata, and data later transferred through the SSH session. It does not directly disclose the SSH private key, but it defeats the server-authentication boundary provided by SSH. The affected privileges are those of the SSH account selected by the user, commonly `ubuntu` or `root`. T ...[truncated 105 chars]- Remediation
View remediation
> "$HOME/.ssh/oracle_known_hosts" # Verify the recorded fingerprint through a trusted channel before connecting. ssh -i \ -o UserKnownHostsFile="$HOME/.ssh/oracle_known_hosts" \ -o StrictHostKeyChecking=yes \ -o ConnectTimeout=10 \ @ "echo connected && hostname" ``` - Do not permit privileged commands or sensitive transfers until the host fingerprint has been verified. ]]>