id: dropbear-weakalgo

info:
  name: Dropbear sshd Weak Key Exchange Algorithms Enabled
  author: pussycat0x
  severity: low
  description: |
    The SSH key exchange algorithm is fundamental to keep the protocol secure. It is what allows two previously unknown parties to generate a shared key in plain sight, and have that secret remain private to the client and server. Over time, some implementations of this algorithm have been identified as weak or vulnerable.
  remediation: |
    Disable the weak algorithms.
  reference: |
    https://www.virtuesecurity.com/kb/ssh-weak-key-exchange-algorithms-enabled
  metadata:
    max-request: 2
    verified: true
    shodan-query: 'product:"Dropbear sshd"'
  tags: network,ssh,dropbear,misconfig

tcp:
  - inputs:
      - data: "\n"

    host:
      - "{{Hostname}}"
      - "{{Host}}:22"

    matchers:
      - type: word
        words:
          - "diffie-hellman-group-exchange-sha1"
          - "diffie-hellman-group1-sha1"
        condition: or