CVE-2022-38337: Mobatek MobaXterm DoS Vulnerability

CVE-2022-38337 Overview

CVE-2022-38337 is a critical hardcoded credentials vulnerability affecting MobaXterm versions prior to v22.1. When a user aborts an SFTP connection, MobaXterm transmits a hardcoded password to the remote server. The server interprets this as a failed authentication attempt, which can trigger security mechanisms like fail2ban, resulting in the user being blocked from the server and effectively causing a Denial of Service (DoS) condition.

Critical Impact

Attackers can exploit this vulnerability to cause legitimate users to be locked out of servers by triggering repeated failed login attempts through SFTP connection aborts, leveraging fail2ban or similar intrusion prevention systems.

Affected Products

• Mobatek MobaXterm versions prior to v22.1
• All editions of MobaXterm (Home and Professional) before v22.1

Discovery Timeline

• 2022-12-06 - CVE-2022-38337 published to NVD
• 2025-04-24 - Last updated in NVD database

Technical Details for CVE-2022-38337

Vulnerability Analysis

This vulnerability falls under CWE-798 (Use of Hard-coded Credentials), representing a significant design flaw in MobaXterm's SFTP connection handling. When a user initiates and then aborts an SFTP session, the application inappropriately sends a hardcoded password value to the remote server during the disconnection process.

The core issue stems from improper connection termination logic where MobaXterm attempts to complete an authentication sequence even during abort operations. Instead of cleanly terminating the TCP connection or sending proper SSH disconnect messages, the client transmits credential data that was never intended to be seen by the server.

This behavior creates a dangerous interaction with server-side security tools. Services like fail2ban monitor authentication logs for failed login attempts and automatically ban IP addresses that exceed a threshold of failures. Since each aborted SFTP connection generates a failed authentication event, repeated aborts can quickly trigger IP bans, preventing the legitimate user from accessing the server.

Root Cause

The root cause is the presence of hardcoded credentials embedded within the MobaXterm application that are transmitted during SFTP connection abort sequences. This represents a fundamental violation of secure coding practices, as hardcoded credentials should never be present in client applications. The implementation fails to properly handle the connection teardown state, inadvertently exposing this embedded password to remote servers during what should be a clean disconnect operation.

Attack Vector

The vulnerability is exploitable over the network without requiring any authentication or user interaction. An attacker with knowledge of this behavior could potentially:

1. Trigger self-inflicted DoS: Simply using MobaXterm and aborting SFTP connections can cause users to lock themselves out of servers
2. Social engineering attacks: Tricking users into repeatedly aborting SFTP connections to specific servers could lock them out of critical infrastructure
3. Information disclosure: The hardcoded password is exposed to any server the user connects to, potentially revealing implementation details

The attack does not require prior access to the target system or any special privileges. The vulnerability manifests through normal client-side operations, where the SFTP connection abort handler transmits the hardcoded credential to the server. For detailed technical analysis, refer to the SSH MITM CVE-2022-38337 Advisory.

Detection Methods for CVE-2022-38337

Indicators of Compromise

• Unusual spikes in failed SSH/SFTP authentication attempts from specific users
• Fail2ban or similar IPS logs showing repeated authentication failures from MobaXterm client IPs
• SSH authentication logs containing the same repeated invalid password across multiple connection attempts
• Users reporting unexpected lockouts from SSH/SFTP servers

Detection Strategies

• Monitor SSH daemon logs (/var/log/auth.log or /var/log/secure) for patterns of rapid failed authentication attempts followed by connection terminations
• Configure SIEM rules to alert on multiple failed SFTP authentications from the same source IP within a short timeframe
• Audit installed software versions across endpoints to identify MobaXterm installations running versions prior to v22.1
• Review fail2ban ban history for patterns consistent with this vulnerability

Monitoring Recommendations

• Implement centralized logging for all SSH/SFTP authentication events across your infrastructure
• Configure alerting for users who are banned by fail2ban to investigate root cause
• Deploy endpoint management solutions to track installed software versions and identify vulnerable MobaXterm installations
• Monitor for network traffic patterns consistent with aborted SFTP sessions

How to Mitigate CVE-2022-38337

Immediate Actions Required

• Upgrade MobaXterm to version v22.1 or later immediately across all endpoints
• Review fail2ban jail configurations and whitelist trusted IP ranges if necessary during the upgrade period
• Audit SSH server logs to identify any users who may have been affected by this vulnerability
• Communicate with users about avoiding SFTP connection aborts until the upgrade is complete

Patch Information

Mobatek has addressed this vulnerability in MobaXterm version v22.1 and later. The updated version properly handles SFTP connection termination without transmitting hardcoded credentials. Users should download the latest version from the Mobaxterm Home Edition Download page or through their Professional Edition license portal.

Workarounds

• Avoid aborting SFTP connections whenever possible; allow transfers to complete or use the proper disconnect functionality
• Temporarily increase fail2ban thresholds on critical servers to prevent lockouts during the upgrade period
• Configure SSH servers to use key-based authentication exclusively, which may mitigate some effects of the invalid password attempts
• Consider using alternative SFTP clients until MobaXterm can be upgraded across the organization

# Temporary fail2ban configuration adjustment (use with caution)
# Edit /etc/fail2ban/jail.local to increase maxretry threshold
[sshd]
enabled = true
maxretry = 10
bantime = 600
findtime = 600