Erlang/OTP SSH Pre-Auth Connection Message Vulnerability Fix
Problem
The Erlang/OTP SSH server's ssh_connection_handler.erl processes SSH connection
protocol messages (channel open, channel request, exec, etc.) via {conn_msg, Msg}
internal events WITHOUT checking whether the connection has reached the authenticated
{connected, _} state. An attacker can send crafted SSH connection protocol messages
before completing authentication, causing arbitrary command execution.
Root Cause
In ssh_connection_handler.erl, the handler:
erlanghandle_event(internal, {conn_msg,Msg}, StateName, #data{...} = D0) ->
does not guard on ?CONNECTED(StateName). All other capability-bearing handlers
(cast, call) properly use when ?CONNECTED(StateName) guards.
Fix
Insert a guard clause BEFORE the existing conn_msg handler that disconnects
when connection messages arrive in a non-authenticated state:
erlanghandle_event(internal, {conn_msg, _Msg}, StateName, _D) when not ?CONNECTED(StateName) -> ?DISCONNECT(?SSH_DISCONNECT_PROTOCOL_ERROR, "Connection message received before authentication was complete");
This preserves normal authenticated behavior while blocking pre-auth attacks.
Usage
pythonimport sys sys.path.insert(0, '/app/environment/skills/evo-erlang-ssh-fix/scripts') from utils import run_fix, validate_fix, find_ssh_connection_handler # End-to-end: find, check, fix, and validate result = run_fix('/app/workspace/otp_src_27.3.2') assert result['success'], f"Fix failed: {result['message']}" # Or validate an already-fixed file fpath = find_ssh_connection_handler('/app/workspace/otp_src_27.3.2') validation = validate_fix(fpath) assert validation['valid'], f"Validation failed: {validation['checks']}"
Key Functions
find_ssh_connection_handler(otp_src_dir)- Locate the file in OTP source treecheck_vulnerability(filepath)- Check if file is vulnerableapply_fix(filepath)- Apply the guard clause fixvalidate_fix(filepath)- Validate fix correctness (clause exists, ordering, etc.)run_fix(otp_src_dir)- End-to-end entry point
