Command Injection Vulnerability in rssh
Summary
CVE-2019-1000018: rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in allowscp permission that can result in Local command execution. Affects rssh versions < 2.3.4-r2. Fixed in 2.3.4-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rssh is a restricted shell designed for use with OpenSSH, allowing only specific commands to be executed by SSH users. It provides an additional layer of security by limiting the actions that can be performed by users. However, rssh version 2.3.4 is vulnerable to a command injection vulnerability (CVE-2019-1000018) in the allowscp permission. This vulnerability allows an authorized SSH user with the allowscp permission to execute arbitrary commands on the local system.
Vulnerability Detail
The command injection vulnerability in rssh version 2.3.4 arises due to improper neutralization of special elements used in a command. An attacker with the allowscp permission can exploit this vulnerability by injecting malicious commands into the SCP command, leading to the execution of arbitrary commands on the local system. This can result in unauthorized access, data leakage, and potential compromise of the entire system. The vulnerability has a CVSS score of 7.8, indicating a high severity level.
How To Fix
Minimum fixed version
2.3.4-r2
This is the first release that contains the fix.
sudo apk add --upgrade rsshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the allowscp permission for SSH users until the rssh package is updated. This can be done by modifying the rssh configuration file and removing the allowscp permission from the list of allowed commands.
Conclusion
The command injection vulnerability in rssh version 2.3.4 can allow an authorized SSH user to execute arbitrary commands on the local system. It is crucial to upgrade to version 2.3.4-r2 or later to mitigate the risk of exploitation. Users can also check if their application is affected by this vulnerability using the Vulert playground (https://vulert.com/scanner) without requiring access to the code or installation. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for rssh →
FAQ
rssh is a restricted shell designed for use with OpenSSH, providing limited command execution capabilities for SSH users.
The vulnerability allows an authorized SSH user with the allowscp permission to execute arbitrary commands on the local system, potentially leading to unauthorized access, data leakage, and compromise of the entire system.
To fix this vulnerability, upgrade rssh to version 2.3.4-r2 or later. This version includes a fix for the command injection vulnerability.
Yes, as a temporary workaround, users can disable the allowscp permission for SSH users until the rssh package is updated. This can be done by modifying the rssh configuration file.
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for rssh.
