Caddy-SSH vulnerable to Authorization Bypass due to incorrect usage of PAM libraryGHSA-gmhj-xjfh-cf6m
HIGHFix: mohammed90/caddy-ssh@4b3e639GHSA-gmhj-xjfh-cf6m is a high-severity (CVSS 7.7) vulnerability in github.com/mohammed90/caddy-ssh. The records list no fixed version yet; check the vendor advisory below and apply the mitigations in the meantime.
Real-World Exposure
github.com/mohammed90/caddy-sshReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.
Description
Not invoking a call to pam_acct_mgmt after a call to pam_authenticate to check the validity of a login can lead to an authorization bypass.
Impact
Exploitability
The attack can be carried over the network. A complex non-standard configuration or a specialized condition is required for the attack to be successfully conducted. The attacker also requires access to a users credentials, be it expired, for an attack to be successful. There is no user interaction required for successful execution. The attack can affect components outside the scope of the target module.
Impact
Using this attack vector, an attacker may access otherwise restricted parts of the system. The attack can be used to gain access to confidential files like passwords, login credentials and other secrets. Hence, it has a high impact on confidentiality. It may also be directly used to affect a change on a system resource. Hence has a medium to high impact on integrity. This attack may not be used to affect the availability of the system. Taking this account an appropriate CVSS v3.1 vector would be AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Root Cause Analysis
In this case, in the following PAM transaction, only a call to pam.Authenticate is used to login a user.
This implies that a user with expired credentials can still login.
The bug can be verified easily by creating a new user account, expiring it with chage -E0 <username> and then trying to log in with the expired credentials.
Patches
This can be fixed by invoking a call to pam.AcctMgmt after a successful call to pam.Authenticate
References
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐹Go | github.com/mohammed90/caddy-ssh | all versions | No fix |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/mohammed90/caddy-ssh, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Remediation status
The records we use list no patched version of github.com/mohammed90/caddy-ssh for GHSA-gmhj-xjfh-cf6m. Check the maintainer's advisory, and where your build allows, override or pin the dependency away from the vulnerable range.
Mitigate without a patch
Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.
Frequently Asked Questions
Is GHSA-gmhj-xjfh-cf6m in your dependencies?
Find it across Go, including transitive dependencies.