CVE-2023-35887: Apache MINA SSHD Information Disclosure

CVE-2023-35887 Overview

CVE-2023-35887 is a Path Traversal vulnerability affecting Apache MINA SSHD, an open-source Java library used for implementing SSH servers. In SFTP servers implemented using Apache MINA SSHD that use a RootedFileSystem, authenticated users may be able to discover "exists/does not exist" information about items outside the rooted tree via paths including parent navigation (..) beyond the root, or involving symlinks.

This information disclosure vulnerability allows attackers to enumerate file system structures outside their authorized directory scope, potentially revealing sensitive information about the server's file system layout.

Critical Impact

Authenticated attackers can bypass the RootedFileSystem sandbox to probe for the existence of files and directories outside their authorized scope, enabling reconnaissance activities that could inform further attacks.

Affected Products

• Apache SSHD versions 1.0 through 2.9.x
• SFTP servers using RootedFileSystem configuration
• Applications built on Apache MINA SSHD with chroot-style file system restrictions

Discovery Timeline

• 2023-07-10 - CVE CVE-2023-35887 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-35887

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal). The flaw exists in how Apache MINA SSHD handles path resolution within its RootedFileSystem implementation.

When an SFTP server is configured with a RootedFileSystem to sandbox users within a specific directory tree, the path validation logic fails to properly handle certain edge cases. Specifically, paths containing parent directory navigation sequences (..) that traverse beyond the root boundary, or paths involving symbolic links that escape the sandbox, are not adequately validated before certain file existence checks are performed.

While the vulnerability does not allow reading file contents or modifying files outside the sandbox, it does leak boolean information about whether files or directories exist at specified paths. This information leakage can be exploited by authenticated users to map the server's file system structure.

Root Cause

The root cause lies in insufficient path canonicalization and validation within the RootedFileSystem class. When processing SFTP requests that check for file existence (such as SSH_FXP_STAT or SSH_FXP_LSTAT operations), the implementation fails to properly normalize paths and verify they remain within the designated root directory before performing the existence check.

The path resolution algorithm does not consistently apply boundary checks across all code paths, allowing crafted requests with .. sequences or symlink references to probe locations outside the intended sandbox.

Attack Vector

The attack requires network access and valid authentication credentials for the SFTP server. An attacker with legitimate SFTP access can craft requests with path traversal sequences to probe for files outside their authorized directory.

The exploitation flow involves:

1. Authenticating to the SFTP server with valid credentials
2. Issuing file status requests with paths containing ../ sequences or symlink references
3. Analyzing server responses to determine file existence based on error codes or response timing
4. Building a map of the external file system structure through iterative probing

This vulnerability is exploitable from a network context and requires low attack complexity, though it does require authentication. The impact is limited to confidentiality of file existence information, with no direct impact on integrity or availability.

Detection Methods for CVE-2023-35887

Indicators of Compromise

• Unusual SFTP request patterns containing multiple .. sequences in file paths
• SFTP requests attempting to access paths outside user home directories
• High volume of file status requests (SSH_FXP_STAT, SSH_FXP_LSTAT) from single sessions
• Log entries showing path resolution errors or permission denials for paths outside sandbox boundaries

Detection Strategies

• Monitor SFTP server logs for path traversal patterns in client requests
• Implement alerting on repeated file existence checks targeting system directories (e.g., /etc, /root, /var)
• Deploy network-based detection rules to identify SSH sessions with suspicious path patterns
• Use behavioral analysis to detect enumeration activities across SFTP sessions

Monitoring Recommendations

• Enable verbose logging on Apache MINA SSHD servers to capture full request paths
• Configure SIEM rules to correlate multiple failed path access attempts from the same user
• Implement anomaly detection for SFTP session behavior deviating from normal user patterns
• Review audit logs periodically for signs of file system reconnaissance activities

How to Mitigate CVE-2023-35887

Immediate Actions Required

• Upgrade Apache MINA SSHD to version 2.10 or later immediately
• Review SFTP server configurations to identify deployments using RootedFileSystem
• Audit user access logs for any evidence of path traversal exploitation attempts
• Consider implementing additional application-level path validation as defense in depth

Patch Information

Users are recommended to upgrade to Apache MINA SSHD version 2.10 or later, which addresses this vulnerability. The fix improves path canonicalization and boundary validation within the RootedFileSystem implementation.

For detailed information about the security fix, refer to the Apache Security Mailing List Thread.

Workarounds

• If immediate patching is not possible, consider implementing additional network-level access controls to limit SFTP access
• Deploy application-level firewall rules to filter requests containing obvious path traversal sequences
• Restrict SFTP access to only necessary users and implement strict authentication controls
• Consider temporarily disabling SFTP functionality if the service is not critical to operations
• Implement file system monitoring to detect unusual access patterns to sensitive directories

For production environments, upgrading to the patched version remains the recommended approach rather than relying on workarounds.