Hi Daniil,
My name is Morgan Jones, software engineering lead for Viasat Secure Mobile.
I sent this to you over email, but have just been granted access to the VyOS bug tracker.
My work PGP key is: https://keys.openpgp.org/search?q=morgan.jones%40viasat.com
I have confirmed a vulnerability in the following VyOS version:
https://github.com/vyos/vyos-nightly-build/releases/tag/1.5-rolling-202503030030
- Artifact: vyos-1.5-rolling-202503030030-generic-amd64.iso
This vulnerability exists in other versions of VyOS too; I have seen it on Sagitta 1.4 and Equuleus 1.3.
We will likely need to pull a CVE, though it is not triggerable by default as far as I know.
We probably should work with a 30 day disclosure window for this vulnerability.
-------
Severity: High (likely)
Impact: All versions of VyOS installed using the same release ISO use the same Dropbear private keys,
resulting in the ability to man in the middle all SSH connections if Dropbear is enabled as the SSH daemon.
Reproducer after installing a system image:
[Host]
```
vyos@vyos:~$ config
vyos@vyos# set interface eth eth0 address dhcp
vyos@vyos# commit; save; exit
vyos@vyos:~$ sudo systemctl enable dropbear --now
vyos@vyos:~$ sudo dropbearkey -y -f /etc/dropbear/dropbear_ed25519_host_key
Public key portion is:
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINRolGQ0jsTE2s6J/GwwzwaW1/E5jpOKCejeWKDcUCob root@vyos
Fingerprint: SHA256:jOukqk0yTJhPubLpTfxx0hK2ykyMEpYFm+ON6SpRYPA
vyos@vyos:~$ sudo sha256sum /etc/dropbear/*key*
409d342d3d96ca66ddcacddd58ae3e230ab5331bf170c0649d852b8ccd291b31 /etc/dropbear/dropbear_ecdsa_host_key
8c7ac47993e5f4714b6777967f8aa11ab7d11c5eb2d8d719ffc9490ad5f360ff /etc/dropbear/dropbear_ed25519_host_key
c5da536e17ed3a9fe5405ff45822ae9c3b1f79fd93450592c004ae4f4ba76ca3 /etc/dropbear/dropbear_rsa_host_key
```
[Remote host]
```
$ ssh vyos@10.99.0.128
The authenticity of host '10.99.0.128 (10.99.0.128)' can't be established.
ED25519 key fingerprint is SHA256:jOukqk0yTJhPubLpTfxx0hK2ykyMEpYFm+ON6SpRYPA.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.99.0.128' (ED25519) to the list of known hosts.
vyos@10.99.0.128's password:
Welcome to VyOS!
┌── ┐
. VyOS 1.5-rolling-202503030030
└ ──┘ current
* Documentation: https://docs.vyos.io/en/latest
* Project news: https://blog.vyos.io
* Bug reports: https://vyos.dev
You can change this banner using "set system login banner post-login" command.
VyOS is a free software distribution that includes multiple components,
you can check individual component licenses under /usr/share/doc/*/copyright
vyos@vyos:~$ exit
$ scp ~/Downloads/vyos-1.5-rolling-202503030030-generic-amd64.iso vyos@10.99.0.128:.
vyos@10.99.0.128's password:
vyos-1.5-rolling-202503030030-generic-amd64.iso 100% 549MB 51.4MB/s 00:10
$ ssh vyos@10.99.0.128
vyos@10.99.0.128's password:
vyos@vyos:~$ ls
vyos-1.5-rolling-202503030030-generic-amd64.iso
vyos@vyos:~$ sudo -s
vbash-4.1# mkdir /mnt/iso
vbash-4.1# mount -o loop vyos-1.5-rolling-202503030030-generic-amd64.iso /mnt/iso
mount: /mnt/iso: WARNING: source write-protected, mounted read-only.
vbash-4.1# mount -o loop -t squashfs /mnt/iso/live/filesystem.squashfs /mnt
vbash-4.1# sha256sum /mnt/etc/dropbear/*key*
409d342d3d96ca66ddcacddd58ae3e230ab5331bf170c0649d852b8ccd291b31 /mnt/etc/dropbear/dropbear_ecdsa_host_key
8c7ac47993e5f4714b6777967f8aa11ab7d11c5eb2d8d719ffc9490ad5f360ff /mnt/etc/dropbear/dropbear_ed25519_host_key
c5da536e17ed3a9fe5405ff45822ae9c3b1f79fd93450592c004ae4f4ba76ca3 /mnt/etc/dropbear/dropbear_rsa_host_key
```
Note that VyOS 1.3 also has a "dropbear-initramfs" folder with similar pregenerated keys in it.
We probably should figure out a way to mitigate this for new builds (i.e. by deleting the dropbear keys during image preparation)
and/or notify users that their dropbear keys aren't unique.
At least it's not OpenSSH, but I'd imagine running dropbear as the SSH daemon isn't unheard of. Does VyOS use dropbear for anything else?
Thanks,
Morgan Jones
<morgan.jones@viasat.com>