oss-sec mailing list archives
CVE-2023-51385, CVE-2023-6004: OpenSSH, libssh: Security weakness in ProxyCommand handling
From: Solar Designer <solar () openwall com>
Date: Tue, 26 Dec 2023 17:16:24 +0100
Hi, This was previously announced as mitigated in OpenSSH 9.6: https://www.openwall.com/lists/oss-security/2023/12/18/2 and is now known as CVE-2023-51385 described as follows:
In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name.
The corresponding libssh issue got assigned CVE-2023-6004, with their advisory here: https://www.libssh.org/security/advisories/CVE-2023-6004.txt and quoted below:
=========================================================== == Subject: Security weakness in ProxyCommand handling == == CVE ID#: CVE-2023-6004 == == Versions: 0.10.x, 0.9.x, 0.8.x == == Summary: ProxyCommand/ProxyJump features enable to inject malicious code through hostname == =========================================================== =========== Description =========== Using the ProxyCommand or the ProxyJump feature enables users to exploit unchecked hostname syntax on the client, which enables to inject malicious code into the command of the above-mentioned features through the hostname parameter. User interaction is required to exploit this issue. ================== Patch Availability ================== Patches addressing the issues have been posted to: https://www.libssh.org/security/ Additionally, libssh 0.10, 0.9 have been issued as security releases to correct the defect. SSH administrators are advised to upgrade to these releases or apply the patch as soon as possible. ================== CVSSv3 calculation ================== CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N (3.9) ========== Workaround ========== Sanitize hostname input ======= Credits ======= Originally reported by Vinci (https://github.com/vin01). Patches provided by Norbert Pocs of the libssh team. ========================================================== == The libssh team ==========================================================
Incidentally, NIST NVD's current CVSS 3.1 score for OpenSSH's CVE-2023-51385 is a ridiculous 9.8. Quite usual for CVSS and NVD. There's a blog post on exploitation via git submodules and on "Vulnerable usage out in the wild" here: https://vin01.github.io/piptagole/ssh/security/openssh/libssh/remote-code-execution/2023/12/20/openssh-proxycommand-libssh-rce.html Alexander
Current thread:
- CVE-2023-51385, CVE-2023-6004: OpenSSH, libssh: Security weakness in ProxyCommand handling Solar Designer (Dec 26)