[prev in list] [next in list] [prev in thread] [next in thread]
List: oss-security
Subject: [oss-security] CVE-2023-51385, CVE-2023-6004: OpenSSH, libssh: Security weakness in ProxyCommand han
From: Solar Designer <solar () openwall ! com>
Date: 2023-12-26 16:16:24
Message-ID: 20231226161624.GA21138 () openwall ! com
[Download RAW message or body]
Hi,
This was previously announced as mitigated in OpenSSH 9.6:
https://www.openwall.com/lists/oss-security/2023/12/18/2
and is now known as CVE-2023-51385 described as follows:
> In ssh in OpenSSH before 9.6, OS command injection might occur if a user
> name or host name has shell metacharacters, and this name is referenced
> by an expansion token in certain situations. For example, an untrusted
> Git repository can have a submodule with shell metacharacters in a user
> name or host name.
The corresponding libssh issue got assigned CVE-2023-6004, with their
advisory here:
https://www.libssh.org/security/advisories/CVE-2023-6004.txt
and quoted below:
> ===========================================================
> == Subject: Security weakness in ProxyCommand handling
> ==
> == CVE ID#: CVE-2023-6004
> ==
> == Versions: 0.10.x, 0.9.x, 0.8.x
> ==
> == Summary: ProxyCommand/ProxyJump features enable to inject
> malicious code through hostname
> ==
> ===========================================================
>
> ===========
> Description
> ===========
>
> Using the ProxyCommand or the ProxyJump feature enables users to exploit
> unchecked hostname syntax on the client, which enables to inject malicious code
> into the command of the above-mentioned features through the hostname parameter.
>
> User interaction is required to exploit this issue.
>
> ==================
> Patch Availability
> ==================
>
> Patches addressing the issues have been posted to:
> https://www.libssh.org/security/
> Additionally, libssh 0.10, 0.9 have been issued
> as security releases to correct the defect. SSH administrators are
> advised to upgrade to these releases or apply the patch as soon
> as possible.
>
> ==================
> CVSSv3 calculation
> ==================
> CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N (3.9)
>
> ==========
> Workaround
> ==========
>
> Sanitize hostname input
>
> =======
> Credits
> =======
>
> Originally reported by Vinci (https://github.com/vin01).
> Patches provided by Norbert Pocs of the libssh team.
>
> ==========================================================
> == The libssh team
> ==========================================================
Incidentally, NIST NVD's current CVSS 3.1 score for OpenSSH's
CVE-2023-51385 is a ridiculous 9.8. Quite usual for CVSS and NVD.
There's a blog post on exploitation via git submodules and on
"Vulnerable usage out in the wild" here:
https://vin01.github.io/piptagole/ssh/security/openssh/libssh/remote-code-execution/2023/12/20/openssh-proxycommand-libssh-rce.html
Alexander
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic