CVE-2020-26301: OS Command Injection in ssh2
Summary
CVE-2020-26301: OS Command Injection in ssh2. Affects ssh2 versions < 1.4.0. Fixed in 1.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ssh2 is a client and server module written in pure JavaScript for node.js. It provides secure remote shell services and file transfer capabilities. The vulnerability identified as CVE-2020-26301 is a command injection vulnerability that affects ssh2 versions prior to 1.4.0. This vulnerability is specific to Windows systems. If a client of the library calls the vulnerable method with untrusted input, it may lead to remote code execution. The issue has been fixed in version 1.4.0.
Vulnerability Detail
The command injection vulnerability in ssh2 arises due to improper handling of user-supplied input. When untrusted input is passed to a specific method, it can be executed as a command on the underlying Windows system. This can result in unauthorized remote code execution, allowing an attacker to take control of the affected system. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
1.4.0
This is the first release that contains the fix.
npm install ssh2@1.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, if upgrading to the latest version is not immediately feasible, it is recommended to avoid passing untrusted input to the vulnerable method. Ensure that all input is properly validated and sanitized before being used as a command argument. Implement strict input validation and filtering to prevent command injection attacks.
Conclusion
The command injection vulnerability in ssh2 (CVE-2020-26301) poses a significant risk to Windows systems. It is crucial to upgrade to version 1.4.0 or later of the ssh2 package to mitigate this vulnerability. Implementing strict input validation and filtering can also serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ssh2 →
FAQ
ssh2 is a client and server module written in pure JavaScript for node.js. It provides secure remote shell services and file transfer capabilities.
The vulnerability allows for command injection, which can lead to unauthorized remote code execution on Windows systems.
Versions of ssh2 prior to 1.4.0 are affected by this vulnerability.
Upgrade to version 1.4.0 or later of the ssh2 package to fix this vulnerability.
No, this vulnerability only affects Windows systems.
