[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20231226161624.GA21138@openwall.com>
Date: Tue, 26 Dec 2023 17:16:24 +0100
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2023-51385, CVE-2023-6004: OpenSSH, libssh: Security weakness in ProxyCommand handling
Hi,
This was previously announced as mitigated in OpenSSH 9.6:
https://www.openwall.com/lists/oss-security/2023/12/18/2
and is now known as CVE-2023-51385 described as follows:
> In ssh in OpenSSH before 9.6, OS command injection might occur if a user
> name or host name has shell metacharacters, and this name is referenced
> by an expansion token in certain situations. For example, an untrusted
> Git repository can have a submodule with shell metacharacters in a user
> name or host name.
The corresponding libssh issue got assigned CVE-2023-6004, with their
advisory here:
https://www.libssh.org/security/advisories/CVE-2023-6004.txt
and quoted below:
> ===========================================================
> == Subject: Security weakness in ProxyCommand handling
> ==
> == CVE ID#: CVE-2023-6004
> ==
> == Versions: 0.10.x, 0.9.x, 0.8.x
> ==
> == Summary: ProxyCommand/ProxyJump features enable to inject
> malicious code through hostname
> ==
> ===========================================================
>
> ===========
> Description
> ===========
>
> Using the ProxyCommand or the ProxyJump feature enables users to exploit
> unchecked hostname syntax on the client, which enables to inject malicious code
> into the command of the above-mentioned features through the hostname parameter.
>
> User interaction is required to exploit this issue.
>
> ==================
> Patch Availability
> ==================
>
> Patches addressing the issues have been posted to:
> https://www.libssh.org/security/
> Additionally, libssh 0.10, 0.9 have been issued
> as security releases to correct the defect. SSH administrators are
> advised to upgrade to these releases or apply the patch as soon
> as possible.
>
> ==================
> CVSSv3 calculation
> ==================
> CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N (3.9)
>
> ==========
> Workaround
> ==========
>
> Sanitize hostname input
>
> =======
> Credits
> =======
>
> Originally reported by Vinci (https://github.com/vin01).
> Patches provided by Norbert Pocs of the libssh team.
>
> ==========================================================
> == The libssh team
> ==========================================================
Incidentally, NIST NVD's current CVSS 3.1 score for OpenSSH's
CVE-2023-51385 is a ridiculous 9.8. Quite usual for CVSS and NVD.
There's a blog post on exploitation via git submodules and on
"Vulnerable usage out in the wild" here:
https://vin01.github.io/piptagole/ssh/security/openssh/libssh/remote-code-execution/2023/12/20/openssh-proxycommand-libssh-rce.html
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
