id: dropbear-cbc-ciphers

info:
  name: Dropbear sshd CBC Mode Ciphers Detection
  author: pussycat0x
  severity: low
  description: |
    The SSH server is configured to support Cipher Block Chaining (CBC) encryption. This may allow an attacker to recover the plaintext message from the ciphertext.
  reference: |
    https://www.tenable.com/plugins/nessus/70658
  remediation: |
    Disable CBC Ciphers.
  metadata:
    max-request: 1
    shodan-query: product:"Dropbear sshd"
    verified: true
  tags: network,ssh,dropbear,detect

tcp:
  - inputs:
      - data: "\n"

    host:
      - "{{Hostname}}"
    port: 22

    matchers:
      - type: word
        words:
          - "cbc"
          - "SSH-"
        condition: and
# digest: 4a0a00473045022002fae16b256b4653ad2b98f85511cd26f00c12b388af06a773784c5a84485c17022100e96053936cf02101d8c3295bc5c5797df04c9fc0e666e5fda59f09208ff75826:922c64590222798bb761d5b6d8e72950