AI analysis
Apache MINA SSHD, a Java library for building SSH clients and servers, fails to properly enforce password checks in the optional sshd-ldap component: a missing check in LdapPasswordAuthenticator makes LDAP-backed password authentication ineffective, so an unauthenticated network attacker can log in without valid credentials. The flaw is triggered when an SSH server built on Apache MINA SSHD versions 1.2.0–2.19.0 or 3.0.0-M1–3.0.0-M5 configures LdapPasswordAuthenticator for password authentication, and successful exploitation grants the attacker the privileges of an LDAP-listed user, compromising confidentiality and integrity of the server. Servers using the built-in sshd-core password mechanisms are not affected, and neither are deployments that do not use sshd-ldap at all. The issue is rated critical (CVSS 9.1) and fixed in versions 2.20.0 and 3.0.0-M6. No public proof-of-concept exists, the CVE is not in CISA's KEV catalog, and no exploitation has been observed in the wild to date.
What to do: Upgrade Apache MINA SSHD to 2.20.0 (or 3.0.0-M6 if on the 3.0 milestone line) in any product or in-house application that ships it. Audit your deployments for the sshd-ldap JAR on the classpath and any LdapPasswordAuthenticator wiring in SSH server configuration — if found and unpatched, assume LDAP-backed password accounts could have been accessed without valid credentials, rotate credentials, and review authentication logs for anomalous logins. As an interim mitigation, disable LdapPasswordAuthenticator and fall back to built-in password or public-key authentication in sshd-core, which is unaffected.
Affected
| Apache MINA SSHD (sshd-ldap optional component, LdapPasswordAuthenticator) | 1.2.0 to 2.19.0 |
| Apache MINA SSHD (sshd-ldap optional component, LdapPasswordAuthenticator) | 3.0.0-M1 to 3.0.0-M5 |
Description
A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.0-M1 to 3.0.0-M5 bypassed authentication checks. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for integrating password and publickey authentication on the server side with an LDAP server. sshd-ldap is an optional component. SSH servers implemented with Apache MINA SSHD are affected only if they use sshd-ldap and do configure an LdapPasswordAuthenticator to be used for password authentication. Normal password authentication via the built-in mechanisms in sshd-core is _not_ affected by this vulnerability, which concerns only LdapPasswordAuthenticator. Users are recommended to upgrade affected applications to version 2.20.0 or 3.0.0-M6, which fix this issue.