256 Characters: The Input That Unlocks Passwordless SSH Accounts
A flaw in Alpine Linux configurations allows attackers to bypass authentication by entering a long string of characters into the password field.
By Kevin Iyer ·
Alpine Linux maintainers confirmed on Thursday that a specific configuration allows attackers to log into devices without a password. The vulnerability, which has existed for a decade, affects systems using the musl C library alongside OpenSSH without Pluggable Authentication Modules. The exploit requires a user account that is set to be passwordless but retains a hash generated by SHA256 or SHA512 functions. When these conditions align, an attacker can gain access by inputting more than 256 characters into the password field of a standard SSH connection.
The flaw stems from how OpenSSH interacts with musl, a lightweight alternative to the standard libc library. Unlike most major distributions, Alpine relies on musl for its core system calls. The vulnerability is triggered specifically when OpenSSH runs on musl without PAM, the framework typically used for handling user authentication and account access checks. While other platforms might use similar configurations, Alpine is the most prominent distribution affected. The maintainers noted that the attack is reliable and does not require multiple attempts to succeed.
Two specific criteria must be met for the exploit to work. The target system must contain at least one user account accessible via a password hashed with SHA256 or SHA512. Additionally, that account must be configured as passwordless in the /etc/shadow file, indicated by an asterisk in the password field. This setup is common for accounts that rely on certificate-based authentication rather than traditional passwords. The maintainers stated that any attacker who can reach the SSH port can log in without knowing any password, noting that it takes one connection, works every time, and needs no retries.
Checkpoint, a security firm that analyzed the issue, explained that the specific hashing functions matter because the SSH daemon borrows the account's salt. Without this borrowed salt, the attack fails. Their testing also confirmed that the account must be active, not merely holding a hash. Checkpoint researchers added that root accounts remain safe under the default PermitRootLogin prohibit password setting. However, any reachable account with doas or sudo rights can still be used to escalate privileges and gain root access.
Alpine is a lightweight Linux distribution widely used in containerized environments and embedded systems. The maintainers have acknowledged the issue and are working on a fix. The vulnerability affects specific versions of Alpine and potentially other distributions that share the same combination of musl, OpenSSH, and PAM-less configurations. Users are advised to review their /etc/shadow files for accounts with asterisks and ensure that active accounts have proper hashes or are disabled if not in use.
The discovery highlights a subtle interaction between low-level system libraries and network services. Because the exploit requires no special tools or complex payloads, it is accessible to a wide range of attackers. The maintainers emphasized that the fix will involve adjusting how OpenSSH handles authentication when running on musl without PAM. Until the patch is widely deployed, administrators of affected systems should monitor their SSH logs for unusual login patterns, particularly from accounts configured with certificate-based authentication.
