CVE-2022-46176 - How Cargo’s Missed SSH Host Key Check Opened the Door to MITM Attacks

CVE-2022-46176 is a serious vulnerability that affected the Cargo package manager, the tool used by most Rust programmers. This bug allowed attackers to perform man-in-the-middle (MITM) attacks by taking advantage of a missing step in SSH host key verification. This vulnerability could have let hackers intercept code or even inject malicious dependencies—without you noticing a thing.

This post will break down what happened in simple terms, show what kind of code and configuration made you vulnerable, give some practical attack examples, and point you to the best resources for fixing the problem.

What Was the Vulnerability?

In simple words: Cargo did not verify SSH host keys when cloning registry indexes or dependencies over SSH.

Imagine you’re downloading some code from GitHub over SSH. Normally, SSH will check if you’re really connecting to GitHub by looking up its trusted public key (host key). If the key doesn’t match, SSH warns you or halts the connection, because something fishy might be going on.

But for a long time, Cargo skipped this check. This meant an attacker sitting on your network could pretend to be the server, show you some code of their own, and you’d never know—because Cargo would trust any host key it saw, including the attacker’s.

How Did This Vulnerability Occur?

Here’s a code snippet representing a simplified version of what Cargo was doing when cloning via SSH:

// (Pseudo-code, simplified for clarity)
fn clone_via_ssh(url: &str) {
    // This ssh command should check host key, but Cargo didn't force verification
    let output = Command::new("git")
        .arg("clone")
        .arg(url)
        .output()
        .expect("failed to execute process");
    // ... do things with the repo
}

It should have made sure the server’s SSH key matched a previously trusted one. But instead, it let the connection go through, even if the host key belonged to someone else!

Any Rust user with Cargo versions before 1.66.1.

Even if you weren’t intentionally using SSH in your projects, you might still have been at risk.

Why? Because Git allows you to rewrite URLs behind the scenes! If you or your company used a config like this:

[url "ssh://git@github.com/"]
    insteadOf = https://github.com/

With this in your ~/.gitconfig, *any* request to https://github.com/—including Cargo’s crates.io registry index—would silently go over SSH instead of HTTPS! If you’re on a company or public network, an attacker could intercept your SSH traffic much more easily than HTTPS.

Exploit Scenario — How an Attacker Could Get You

Let’s say you’re at a coffee shop using public Wi-Fi, and you cargo build on your latest project. An attacker on the same network could:

You unknowingly download and run malicious code.

The attacker could inject a backdoor or steal secrets—right through your dependency update!

How Was This Fixed?

Rust 1.66.1 and later force host key verification for SSH. If the server’s key isn’t already known and trusted, Cargo will abort the connection.

Here’s a part of the official Rust security advisory:

> All Rust versions containing Cargo before 1.66.1 are vulnerable. ... Rust 1.66.1 will ensure Cargo checks the SSH host key and abort the connection if the server's public key is not already trusted.

When you upgrade to Rust 1.66.1 or later, Cargo will do it right

// Conceptually, now SSH host keys are checked
fn clone_via_ssh_secure(url: &str) {
    // git and SSH will abort if the host key is new or mismatched
    let output = Command::new("git")
        .arg("clone")
        .arg(url)
        .output()
        .expect("failed to execute process");
}

If the key doesn’t match, you’ll see an error like this

WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
...

rustup update stable

 - Clean Up SSH Known Hosts: Check ~/.ssh/known_hosts for unexpected GitHub entries. - Minimize SSH Usage for Dependencies: Unless necessary, use HTTPS for cargo dependencies. - Audit Your Git Config: Look for and remove risky insteadOf` rules.

---

## References and Further Reading

- Official Rust Security Advisory for CVE-2022-46176
- NIST NVD Entry for CVE-2022-46176
- Details about git’s url.insteadOf

---

## Conclusion

CVE-2022-46176 was a subtle but severe problem for everyone using Cargo. If you updated or built Rust projects before 2023, your system could have silently approved a hacker’s fake code. The fix is simple: upgrade your toolchain, review your config, and be aware of secure software practices. Stay safe—and always check those host keys!

---

*Are your systems up-to-date? Don’t wait. Even a brief window of MITM risk can lead to long-term damage!*

Timeline

Published on: 01/11/2023 21:15:00 UTC
Last modified on: 01/19/2023 19:07:00 UTC