Hackers Begin Exploiting OpenSSH SSHole Authentication Bypass Vulnerability

Attackers have started targeting the SSHole authentication bypass affecting certain OpenSSH servers, according to new SANS Internet Storm Center findings.

The flaw allows remote attackers to access some password-disabled Linux accounts by submitting an unusually long password, without knowing valid credentials or holding an SSH key.

SANS researcher Johannes Ullrich reported the first clear exploit attempts on November 5, using passwords made entirely of repeated “A” characters.

His Cowrie SSH honeypots recorded 232 long-password requests that day, followed by 713 on November 6. These figures measure suspicious requests, not confirmed compromises or separate attackers.

Long-password activity first appeared on November 1, but Ullrich said those early entries looked like broken brute-force scripts rather than deliberate SSHole exploitation. Some scripts placed download commands into password fields. Cowrie records only the first 255 password characters, limiting how fully researchers can examine attempts involving longer inputs.

The leading scanner addresses included 213.86.169.133, 152.233.50.185 and 92.255.57.7, with 48, 44 and 43 recorded attempts respectively. Ullrich suspected some honeypot logins succeeded, but his report did not confirm successful sessions. The evidence therefore supports active exploitation attempts, while leaving their full outcome unresolved.

OpenSSH SSHole Vulnerability Exploited

Disclosed by researcher Özgün Kültekin, SSHole affects OpenSSH running with musl libc when password checks occur without PAM, the Linux login framework.

As covered in Cybersecurity News’s earlier OpenSSH report, exploitation also requires enabled password authentication, a target account whose stored password field is *, and another local account containing a valid SHA-crypt password hash.

The researcher’s technical disclosure explains the failure. When a password exceeds 256 bytes, musl’s crypt() function can return * to signal an error. OpenSSH can compare that value with the target account’s stored * and accept the login. The documented attack range is 257 to 1,024 bytes. Accounts with valid password hashes are not bypassed this way.

OpenSSH 10.6p2 fixes the issue, and Alpine has released patched packages. Administrators should install their distribution’s updates and restart sshd.

Where patching must wait, setting PasswordAuthentication no blocks this attack path. StepSecurity’s testing also confirmed protection when password checks use PAM. Check package revisions because backported fixes may retain older OpenSSH version banners.

Review successful password logins to key-only accounts, especially failures followed by acceptance within one session. Earlier SSH honeypot research shows why post-login monitoring matters.

The cited evidence does not establish an SSH option that leaks passwords or API keys to GitHub. That claim is separate from this authentication bypass and should not appear in the headline.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Begin Exploiting OpenSSH SSHole Authentication Bypass Vulnerability appeared first on Cyber Security News.