Command Injection Vulnerability in OpenSSH
Summary
CVE-2023-51385: In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. Affects openssh across 2 version ranges.
< 7ef3787c84b6b524501211b11a26c742f829af1a
< 9.0_p1-r5
Fixed in 9.0_p1-r5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSH is an open-source implementation of the SSH protocol suite, providing secure remote login, file transfer, and tunneling capabilities. It is widely used in Linux and Unix-like systems for secure communication. However, a vulnerability has been discovered in OpenSSH that allows for command injection if a user name or host name contains shell metacharacters. This vulnerability can be exploited by an attacker through an untrusted Git repository submodule.
Vulnerability Detail
The command injection vulnerability in OpenSSH arises when a user name or host name with shell metacharacters is used in certain situations. This can occur when an expansion token references the name. An attacker can leverage this vulnerability by manipulating the user name or host name in a submodule of an untrusted Git repository. By injecting malicious commands, the attacker can execute arbitrary code on the target system, potentially leading to unauthorized access, data leakage, or further compromise.
How To Fix
Minimum fixed version
9.0_p1-r5
This is the first release that contains the fix.
sudo apk add --upgrade opensshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can sanitize user names and host names before using them in expansion tokens. This can be done by removing or escaping any shell metacharacters present in the input. However, this workaround is not foolproof and may not provide complete protection against command injection attacks. It is strongly advised to apply the official fix by updating OpenSSH to the latest version.
Conclusion
In conclusion, the command injection vulnerability in OpenSSH can be exploited by manipulating user names or host names with shell metacharacters. It is crucial to update OpenSSH to the latest version to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for openssh →
FAQ
OpenSSH is an open-source implementation of the SSH protocol suite, providing secure remote login, file transfer, and tunneling capabilities.
The command injection vulnerability in OpenSSH arises when a user name or host name with shell metacharacters is used in certain situations, allowing an attacker to execute arbitrary code.
Exploiting this vulnerability can lead to unauthorized access, data leakage, or further compromise of the target system.
To fix this vulnerability, it is recommended to update OpenSSH to version 9.6 or later.
A temporary workaround involves sanitizing user names and host names before using them in expansion tokens, but it is advised to apply the official fix by updating OpenSSH.
Related vulnerabilities
Recent vulnerabilities recorded for openssh.
