CVE-2023-46446

What it actually does

Allows attackers to inject or remove SSH packets and emulate shell behavior to seize control of the client side of an SSH session.

Why it matters to the business

Attackers can hijack interactive SSH sessions, potentially leading to unauthorized command execution, credential theft, or lateral movement inside environments that rely on AsyncSSH for automation or remote management.

How an attack unfolds

An attacker positioned on the network path performs packet injection or removal against an AsyncSSH client connection and uses shell emulation to impersonate the server, ultimately gaining control of the client session.

How to fix it

Upgrade ronf/asyncssh to the fixed commit 0d6de9aec1a81a4f6ff7400c24b699eb6137fba3 (equivalent to version 2.14.1 or newer).

How to confirm the fix worked

Verify the installed AsyncSSH version or commit hash matches or exceeds the fixed revision; re-test SSH client connections for proper session termination behavior.

Typical attack path

1. Establish network position to observe or intercept SSH traffic
2. Inject or strip selected packets to disrupt normal protocol state
3. Emulate legitimate shell responses to maintain the illusion of a valid server
4. Issue commands or capture input from the client once session control is obtained

How to detect it

Inspect network captures and SSH client logs for unexpected packet sequences, abrupt session state changes, or shell output that does not match server behavior.

What your security team should do

• Apply the fixed commit immediately in all environments using AsyncSSH clients
• Review network segmentation and encryption requirements for SSH traffic
• Add version pinning and dependency scanning to CI pipelines to prevent regression