CVE-2016-10009

What it actually does

Untrusted search path vulnerability in ssh-agent.c allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.

Why it matters to the business

Attackers can execute malicious code on servers during SSH sessions that use agent forwarding, leading to server compromise, data theft, or lateral movement across infrastructure.

How an attack unfolds

An attacker first gains control of an SSH client with agent forwarding enabled or intercepts the forwarded socket, then places a malicious PKCS#11 module in the search path; when the server-side ssh-agent processes the socket, it loads and executes the attacker's module, granting arbitrary code execution.

How to fix it

Upgrade OpenSSH to 7.4 or later (fixed in commit 9476ce1dd37d3c3218d5640b74c34c65e5f4efe5); for gitlab (Bitnami) upgrade to 14.1.2. Disable agent forwarding where unnecessary and restrict socket permissions.

How to confirm the fix worked

Verify OpenSSH version >= 7.4 on all systems; confirm fixed commit or package version in gitlab (Bitnami) deployments; test agent forwarding with known-good modules only and audit search paths.

Typical attack path

1. Gain control of SSH client or agent socket forwarding
2. Position malicious PKCS#11 module in untrusted search path
3. Initiate SSH connection that triggers ssh-agent loading via forwarded socket
4. Execute arbitrary code on target server

How to detect it

Review SSH daemon and agent logs for forwarded agent sockets from untrusted sources; inspect loaded PKCS#11 modules and processes spawned by ssh-agent; search audit trails for unexpected module loads during SSH sessions.

• ssh-agent.*PKCS#11
• forwarded agent-socket
• untrusted search path.*ssh-agent
• ssh-agent loading module from unexpected directory

What your security team should do

• Immediately upgrade all affected OpenSSH instances to fixed versions
• Disable SSH agent forwarding unless explicitly required
• Audit and restrict forwarded agent sockets
• Monitor EPSS trend and exploit availability for prioritization