Key Exchange without Entity Authentication
| Property | |
|---|---|
| Language |  |
| Severity |  |
| CWE | CWE-322: Key Exchange without Entity Authentication |
| OWASP | A02:2021 - Cryptographic Failures |
| Confidence Level | Medium |
| Impact Level | Low |
| Likelihood Level | Low |
Description#
The code disables SSH host key verification by using ‘ssh.InsecureIgnoreHostKey()’, meaning it does not check if the server’s identity is genuine. This makes SSH connections vulnerable to connecting to malicious or unexpected servers.
Impact#
If exploited, attackers could perform man-in-the-middle attacks, intercepting or altering sensitive data sent over SSH connections. This compromises the confidentiality and integrity of communications, potentially leading to unauthorized access, data leaks, or further attacks on internal systems.