MTPutty Sensitive Information Disclosure Vulnerability Allowing SSH Password Exposure

A vulnerability in MTPutty version 1.0.1.21 allows local attackers to disclose sensitive information by accessing SSH connection passwords through the Windows PowerShell process listing. Exploitation involves running a PowerShell command that retrieves the full command line of MTPutty processes, revealing plaintext SSH credentials.

Impact

Successful exploitation of this vulnerability allows for unauthorized access to SSH passwords, which could lead to unauthorized access to systems or data via SSH.

Reproduction

To reproduce this vulnerability, open MTPutty and create a new SSH connection. Once connected, execute a PowerShell command to retrieve the command line of the MTPutty process. The output will include the SSH password in plaintext.