CVE-2025-32728
📋 TL;DR
OpenSSH versions before 10.0 have a bug where the DisableForwarding directive fails to properly disable X11 and agent forwarding as documented. This affects systems using OpenSSH with DisableForwarding configured, potentially allowing unauthorized forwarding despite explicit configuration.
💻 Affected Systems
- OpenSSH
📦 What is this software?
Openssh by Openbsd
⚠️ Risk & Real-World Impact
Worst Case
An authenticated attacker could bypass forwarding restrictions to tunnel X11 sessions or SSH agent connections, potentially accessing sensitive data or pivoting to other systems.
Likely Case
Limited impact since exploitation requires authenticated access and specific misconfiguration; most likely results in unintended forwarding capabilities rather than direct compromise.
If Mitigated
Minimal impact if proper network segmentation and access controls are in place, as the vulnerability only affects forwarding functionality.
🎯 Exploit Status
Exploitation requires authenticated SSH access and knowledge of the misconfiguration.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: OpenSSH 10.0
Vendor Advisory: https://www.openssh.com/txt/release-10.0
Restart Required: Yes
Instructions:
1. Upgrade OpenSSH to version 10.0 or later. 2. Restart sshd service. 3. Verify configuration.
🔧 Temporary Workarounds
Disable forwarding explicitly
linuxManually disable X11Forwarding and AllowAgentForwarding in sshd_config
echo 'X11Forwarding no' >> /etc/ssh/sshd_config
echo 'AllowAgentForwarding no' >> /etc/ssh/sshd_config
systemctl restart sshd
🧯 If You Can't Patch
- Remove DisableForwarding directive and explicitly set X11Forwarding no and AllowAgentForwarding no
- Implement network-level restrictions on forwarding ports
🔍 How to Verify
Check if Vulnerable:
Check sshd version with 'sshd -V 2>&1 | head -1' and verify if below 10.0 AND DisableForwarding is configured in sshd_configCheck Version:
sshd -V 2>&1 | head -1Verify Fix Applied:
Verify sshd version is 10.0+ and test forwarding functionality with DisableForwarding enabled📡 Detection & Monitoring
Log Indicators:
- Successful X11 or agent forwarding sessions when DisableForwarding is configured
Network Indicators:
- Unexpected X11 or SSH agent connections from restricted hosts
SIEM Query:
source="sshd" AND ("X11 forwarding" OR "agent forwarding")🔗 References
- https://ftp.openbsd.org/pub/OpenBSD/patches/7.6/common/013_ssh.patch.sig
- https://github.com/openssh/openssh-portable/commit/fc86875e6acb36401dfc1dfb6b628a9d1460f367
- https://lists.mindrot.org/pipermail/openssh-unix-dev/2025-April/041879.html
- https://www.openssh.com/txt/release-10.0
- https://www.openssh.com/txt/release-7.4
- https://lists.debian.org/debian-lts-announce/2025/05/msg00008.html
- https://security.netapp.com/advisory/ntap-20250425-0002/
