SSH Protocol Flaw CVE-2023-48795 Terrapin Attack: All You Need To Know

The Terrapin attack (CVE-2023-48795) is a novel vulnerability in the SSH protocol that allows a man-in-the-middle attacker to truncate cryptographic information during the SSH handshake, potentially downgrading signature algorithms and bypassing security features. By strategically injecting packets and stripping the EXT_INFO message, attackers can force weaker authentication methods, disable keystroke timing obfuscation, and compromise the security of SSH connections. The vulnerability affects multiple SSH client and server implementations, including OpenSSH, and can be mitigated by updating to patched versions or disabling specific cipher configurations. Fabian Bäumer, Marcus Brinkmann and Jörg Schwenk of Ruhr University Bochum, who found the flaw, report that at least 77% of SSH servers on the internet supported at least one mode that can be exploited in practice. OpenSSH 9.6 counters it with a “strict KEX” extension that drops the connection on unexpected messages during key exchange and resets the sequence counter, but only when both client and server support it. So patching just your server leaves the door ajar.