CVE-2024-45337

CVE-2024-45337 is a critical authorization bypass vulnerability affecting applications and libraries that improperly use the connection.serverAuthenticate function, specifically the ServerConfig.PublicKeyCallback in Go's x/crypto/ssh package. This flaw allows attackers to potentially bypass authorization by manipulating the order of public keys presented during SSH authentication, leading to incorrect security decisions by vulnerable applications. With a CVSS score of 9.1 (CRITICAL), the vulnerability has a network attack vector, low attack complexity, and can result in high confidentiality and integrity impacts without requiring user interaction. Its high EPSS score and FAUCET Risk Score indicate a significant likelihood of exploitation. While there is no evidence of active exploitation, nor publicly available exploit code in Metasploit, Nuclei, or ExploitDB, the vulnerability has garnered community discussion, including mentions of a fix on GitHub and a blog post detailing its discovery and patching.