Cargo is a popular Rust package manager that is widely used for managing Rust project dependencies. Recently, a vulnerability has been identified in Cargo, which allows for man-in-the-middle (MITM) attacks due to a lack of SSH host key verification when cloning indexes and dependencies via SSH. This vulnerability has been assigned CVE-2022-46176.

Affected Versions

All Rust versions containing Cargo before version 1.66.1 are vulnerable, and users are advised to update as soon as possible to mitigate the risk. Note that even if you don't explicitly use SSH for alternate registry indexes or crate dependencies, you might still be affected by this vulnerability if you have configured git to replace HTTPS connections to GitHub with SSH through git's [url.<base>.insteadOf][1] setting. This may cause you to clone the crates.io index through SSH unknowingly.

Exploit Details

An attacker could exploit this vulnerability by intercepting the data between the user's device and the SSH server when cloning indexes and dependencies using Cargo. The attacker can then modify the data, perform MITM attacks, and potentially gain access to sensitive information or inject malicious code into the target system.

The root cause of this vulnerability lies in Cargo not performing SSH host key verification for indexes and dependencies. By skipping this critical security step, Cargo allows connections to untrusted servers, making it vulnerable to MITM attacks.

Here's an example illustrating the potential risk posed by the vulnerability

// User's Cargo.toml file
[dependencies]
some_crate = { git = "ssh://git@github.com/some_user/some_crate.git" }

In this scenario, an attacker can potentially intercept the communication between the user's device and the SSH server while attempting to access the some_crate repository.

Rust 1.66.1 and Cargo's Fix

In the Rust 1.66.1 release, Cargo has been updated to correctly check the SSH host key and abort the connection if the server's public key is not trusted. This fix significantly reduces the risk of MITM attacks by preventing connections to unverified servers.

Recommendation

For users who are running any Rust version containing Cargo older than 1.66.1, it is highly recommended that you update your Rust version and ensure that Cargo checks the SSH host key to avoid this vulnerability. Use the following command to upgrade your Rust version:

$ rustup update stable

Conclusion

CVE-2022-46176 is a significant security vulnerability in the widely-used Cargo Rust package manager. By allowing SSH connections without verifying the host key, Cargo inadvertently opens the door to man-in-the-middle attacks. It is essential for users to upgrade to Rust 1.66.1 or newer to protect themselves from potential exploits and maintain secure practices when using Rust and Cargo.

[1]: https://git-scm.com/docs/git-config#Documentation/git-config.txt-urlbaseinsteadOf "Git Config Documentation: url..insteadOf"
[Rust Security Response WG]: https://blog.rust-lang.org/inside-rust/202/09/03/Security-Response.html "Rust Security Response Working Group"

Timeline

Published on: 01/11/2023 21:15:00 UTC
Last modified on: 01/19/2023 19:07:00 UTC