id: dropbear-cbc-ciphers

info:
  name: Dropbear sshd CBC Mode Ciphers Detection
  author: pussycat0x
  severity: low
  description: |
    The SSH server is configured to support Cipher Block Chaining (CBC) encryption. This may allow an attacker to recover the plaintext message from the ciphertext.
  remediation: |
    Disable CBC Ciphers.
  reference: |
    https://www.tenable.com/plugins/nessus/70658
  metadata:
    max-request: 2
    verified: true
    shodan-query: 'product:"Dropbear sshd"'
  tags: network,ssh,dropbear,detect

tcp:
  - inputs:
      - data: "\n"

    host:
      - "{{Hostname}}"
      - "{{Host}}:22"

    matchers:
      - type: word
        words:
          - "cbc"
          - "SSH-"
        condition: and