Loading vulnerability…
CVE-2024-45337 is an authorization-bypass condition affecting applications and libraries using golang.org/x/crypto/ssh that make security-relevant decisions from external state populated by ServerConfig.PublicKeyCallback. SSH clients may probe whether multiple public keys are acceptable without proving possession of each corresponding private key. Consequently, callback invocation order does not reliably identify the key that ultimately authenticated the session. An attacker can offer keys A and B, authenticate using A, and cause a vulnerable implementation to associate the established connection with B, despite not controlling B's private key. The flaw is in unsafe application use of the callback contract rather than public-key cryptographic verification itself.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (2 hidden).
This repository provides a proof-of-concept exploit for CVE-2024-45337, targeting Gitea (<= 1.22.4) and Forgejo (<= 7.0.11, 9.0.2) instances using the internal SSH server built with vulnerable versions of golang.org/x/crypto. The exploit leverages a flaw in the SSH authentication logic, allowing an attacker with a valid account and knowledge of a victim's public key to impersonate that user and access their repositories via SSH. The main exploit is implemented in 'ssh_cve-2024-45337.py', a Python script that wraps SSH connections and manipulates the authentication process using the Paramiko library. The script requires the attacker's private key and the victim's public key, both provided via environment variables. The README.md provides detailed setup and usage instructions, including how to configure a vulnerable Forgejo instance using Docker Compose (docker-compose.forgejo.yml) and how to use the exploit script as a GIT_SSH wrapper for git operations. The repository structure is straightforward: it includes the exploit script, a requirements.txt for dependencies (Paramiko), a Docker Compose file for setting up a test Forgejo instance, and documentation. The exploit is a proof-of-concept and does not include weaponized or automated payloads beyond demonstrating unauthorized access. The main attack vector is network-based, targeting SSH services on the vulnerable platforms. Several endpoints are fingerprintable, including file paths for SSH keys, localhost network addresses, and specific TCP ports used in the demonstration.
This repository is a proof-of-concept (POC) exploit for CVE-2024-45337, targeting a vulnerability in a custom SSH server implementation (cvessh) by NHAS. The exploit is written in Go and consists of a single main code file (main.go) that demonstrates how to bypass SSH public key authentication by crafting a fake signer that always produces a valid signature for a given public key. The exploit connects to a specified SSH server (default 127.0.0.1:2222) and attempts to authenticate using the provided public key file (default id_ed25519.pub). If the server is vulnerable, the exploit establishes an SSH session, demonstrating unauthorized access. The repository includes build instructions, a reference to a dummy vulnerable server for testing, and is structured as a typical Go project with supporting files for dependencies and GitHub Actions CI. The exploit is a POC and does not include weaponized or post-exploitation payloads.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
72 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability referenced by the openSUSE-SU-2026:21603-1 advisory as affecting installed gitea-tea-related packages; no further technical detail is provided in the content.
An authorization bypass vulnerability in misused SSH server configurations where passing a callback type other than public key could skip source-address validation.
An authorization bypass vulnerability in misused SSH server configurations that allowed source-address validation to be skipped under certain callback handling conditions.
An authorization-bypass vulnerability in golang.org/x/crypto/ssh caused by misuse of ServerConfig.PublicKeyCallback.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.