# pam-ussh may be tricked into using another logged in user's ssh-agent

pam-ussh trusts user-controlled SSH_AUTH_SOCK, letting a local user point sudo's PAM stack at another logged-in user's ssh-agent socket and authenticate with their certificate.

- Payout: hidden
- Severity: medium
- Program: Uber
- Found by: solardiz
- Disclosed: 2017-03-20
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/204802
- Library page: https://bugbountylibrary.com/r/h1%3A204802
- Tags: area:oss domain:oss impact:privesc kind:bounty platform:hackerone sev:medium tech:go tech:linux technique:source-review vuln:access-control vuln:auth-bypass vuln:privilege-escalation

**Target:** PAM module for sudo authentication (Go)
**Root cause:** pam-ussh reads SSH_AUTH_SOCK from the environment to locate the ssh-agent socket instead of deriving it from the authenticated user's own session. Since sudo runs the PAM stack as root, the socket's Unix file permissions are bypassed.
**Steps:**
1. Login as a non-privileged user on a host with pam-ussh in sudo's PAM stack.
2. List `/tmp/ssh-*` and the process list to find another logged-in user's ssh-agent socket `/tmp/ssh-RND/agent.PID`.
3. Invoke `SSH_AUTH_SOCK=/tmp/ssh-RND/agent.PID sudo bash` with RND/PID from the listing.
4. pam-ussh (running as root) connects to that socket and authenticates using the victim's CA-signed certificate.
**How found:** Source review of newly open-sourced pam-ussh: noticed the module reads SSH_AUTH_SOCK from the environment and that docs recommend it for sudo's PAM stack, which runs as root — implying Unix socket permissions are bypassed.
**Exploitation:** Attacker sets SSH_AUTH_SOCK to the victim's agent socket path and runs sudo; root-privileged PAM stack connects to the socket despite Unix permissions, authenticating the attacker as the victim without possessing any certificate.
**Escalation:** Any local user, including a compromised service pseudo-user with sudo reach, can gain root once another user with a valid cert is logged in; attacker can wait for that condition.
**Insight:** When a privileged PAM/SUID component reads identity or socket paths from environment variables, check whether it should instead derive them from the target account's session; env-controlled paths let root bypass file permissions on other users' IPC endpoints.