Description

Detects when an SSH client in Go is configured to accept any host key without verification. This bypasses an important security mechanism that protects against man-in-the-middle attacks by skipping the verification of remote server authenticity.

Detection Strategy

• Check if the golang.org/x/crypto/ssh package is imported in the code

• Look for SSH client configuration objects (ssh.ClientConfig)

• Verify if the HostKeyCallback configuration is set to accept any host key (like ssh.InsecureIgnoreHostKey())

• Report a security issue if the SSH client is configured to ignore host key verification

Vulnerable code example

package main

import (
    "golang.org/x/crypto/ssh"
)

func main() {
    // VULNERABLE: Disables host key verification, allowing MITM attacks...

✅ Secure code example

package main

import (
    "golang.org/x/crypto/ssh"
    "golang.org/x/crypto/ssh/knownhosts"
    "log"
    "os"
    "path/filepath"...