N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-pchf-49fh-w34r

GHSA-pchf-49fh-w34r: Soft Serve Affected by an Authentication Bypass

Impact

What kind of vulnerability is it? Who is impacted?

This issue impacts every Soft Serve instance.

A critical authentication bypass allows an attacker to impersonate any user (including Admin) by "offering" the victim's public key during the SSH handshake before authenticating with their own valid key. This occurs because the user identity is stored in the session context during the "offer" phase and is not cleared if that specific authentication attempt fails.

Patches

Has the problem been patched? What versions should users upgrade to?

Yes, please upgrade to version 0.11.3 as soon as possible.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

You need to upgrade

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-pchf-49fh-w34r

GHSA-pchf-49fh-w34r:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/charmbracelet/soft-serve	go	<= 0.11.2	0.11.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a critical authentication bypass in Soft Serve's SSH server. It allows an attacker to impersonate any user, including an administrator, by exploiting a flaw in how the session context was managed during public key authentication.

The attack unfolds in two stages during the SSH handshake:

Context Poisoning: The attacker first presents the victim's public key. The vulnerable ssh.SSHServer.PublicKeyHandler function would identify the victim as the user and store their identity in the session context. The attacker, not possessing the victim's private key, would fail the subsequent authentication challenge for this key.
Authentication with Attacker's Key: The SSH protocol allows the client to try another key. The attacker then presents their own valid public key and successfully authenticates.

The core of the vulnerability lies in the ssh.AuthenticationMiddleware. The original version of this middleware did not re-validate the user's identity based on the key that ultimately succeeded in authenticating. It trusted the user identity already present in the context, which was the victim's from the first failed attempt. Consequently, the attacker, having authenticated with their own key, was granted the permissions and identity of the victim.

The patch rectifies this by:

Removing the logic in ssh.SSHServer.PublicKeyHandler that prematurely set the user in the context.
Adding logic to ssh.AuthenticationMiddleware to always look up the user based on the successfully authenticated public key and update the session context, ensuring the correct user identity is used for authorization.

Vulnerable functions

ssh.SSHServer.PublicKeyHandler

pkg/ssh/ssh.go

This function was responsible for handling public keys offered during the SSH handshake. In the vulnerable version, it would look up the user corresponding to any presented public key and immediately store that user in the session context, before the client had proven ownership of the key. This allowed an attacker to 'poison' the context with a victim's identity by presenting the victim's public key, which they do not need to own. The patch removes this premature context-setting logic.

ssh.AuthenticationMiddleware

pkg/ssh/middleware.go

This middleware is executed after a successful SSH authentication. The vulnerability existed because the original implementation failed to verify and set the authenticated user's identity in the session context. It implicitly trusted the user identity that was already in the context, which could have been poisoned by a call to `PublicKeyHandler` with a victim's key. The patch fixes this by explicitly looking up the user based on the public key that was actually used for successful authentication (`pk`) and overwriting the context with the correct user identity.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-pchf-49fh-w34r: Soft Serve Affected by an Authentication Bypass

Impact

Patches

Workarounds

GHSA-pchf-49fh-w34r:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

GHSA-pchf-49fh-w34r: Soft Serve Affected by an Authentication Bypass

Impact

Patches

Workarounds

Technical Details

Basic Information

Basic Information

N/A

N/A

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI