CVE-2024-39223

What it actually does

The flaw permits bypassing SSH host key verification by setting HostKeyCallback to ssh.InsecureIgnoreHostKey, enabling man-in-the-middle interception of SSH sessions.

Why it matters to the business

Organizations face risk of unauthorized interception of encrypted communications, potential data exposure, and compliance issues, though low EPSS and absence from KEV indicate limited observed exploitation urgency.

How an attack unfolds

An attacker supplies or modifies code using the vulnerable gost SSH implementation to assign ssh.InsecureIgnoreHostKey as the callback, connects to a malicious server impersonating a legitimate host, and intercepts all session traffic without detection.

How to fix it

Upgrade gost to a version that enforces proper host key verification and remove any usage of ssh.InsecureIgnoreHostKey; enforce strict host key checking policies across all SSH clients and services.

How to confirm the fix worked

Audit source code and binaries for references to InsecureIgnoreHostKey; perform connection tests using mismatched host keys to confirm verification enforcement.

Typical attack path

1. Locate deployments of gost v2.11.5 exposing SSH services
2. Prepare a rogue SSH server configured to mimic the target identity
3. Force or inject the InsecureIgnoreHostKey callback into the client or service configuration
4. Initiate SSH connections to capture and decrypt intercepted communications

How to detect it

Search application source, binaries, and configuration files for the InsecureIgnoreHostKey string; review SSH-related logs for sessions that complete without host key validation events.

• ssh.InsecureIgnoreHostKey
• InsecureIgnoreHostKey

What your security team should do

• Scan codebases and running instances for gost v2.11.5 and the insecure callback pattern
• Replace all instances with a patched release that validates host keys
• Add runtime monitoring for SSH sessions that skip host verification
• Update internal secure coding standards to prohibit insecure host key callbacks