CVE-2023-51385, CVE-2023-6004: OpenSSH, libssh: Security weakness in ProxyCommand handling

                							

                <!--X-Body-Begin-->
<!--X-User-Header-->

oss-sec
mailing list archives
<!--X-User-Header-End-->
<!--X-TopPNI-->

By Date

By Thread

</form>

<!--X-TopPNI-End-->
<!--X-MsgBody-->
<!--X-Subject-Header-Begin-->
CVE-2023-51385, CVE-2023-6004: OpenSSH, libssh: Security weakness in ProxyCommand handling

<!--X-Subject-Header-End-->
<!--X-Head-of-Message-->

From: Solar Designer &lt;solar () openwall com&gt;

Date: Tue, 26 Dec 2023 17:16:24 +0100

<!--X-Head-of-Message-End-->
<!--X-Head-Body-Sep-Begin-->

<!--X-Head-Body-Sep-End-->
<!--X-Body-of-Message-->
Hi,

This was previously announced as mitigated in OpenSSH 9.6:

https://www.openwall.com/lists/oss-security/2023/12/18/2

and is now known as CVE-2023-51385 described as follows:

In ssh in OpenSSH before 9.6, OS command injection might occur if a user
name or host name has shell metacharacters, and this name is referenced
by an expansion token in certain situations.  For example, an untrusted
Git repository can have a submodule with shell metacharacters in a user
name or host name.

The corresponding libssh issue got assigned CVE-2023-6004, with their
advisory here:

https://www.libssh.org/security/advisories/CVE-2023-6004.txt

and quoted below:

===========================================================
== Subject:     Security weakness in ProxyCommand handling
==
== CVE ID#:     CVE-2023-6004
==
== Versions:    0.10.x, 0.9.x, 0.8.x
==
== Summary:     ProxyCommand/ProxyJump features enable to inject
                malicious code through hostname
==
===========================================================

===========
Description
===========

Using the ProxyCommand or the ProxyJump feature enables users to exploit
unchecked hostname syntax on the client, which enables to inject malicious code
into the command of the above-mentioned features through the hostname parameter.

User interaction is required to exploit this issue.

==================
Patch Availability
==================

Patches addressing the issues have been posted to:
https://www.libssh.org/security/
Additionally, libssh 0.10, 0.9 have been issued
as security releases to correct the defect.  SSH administrators are
advised to upgrade to these releases or apply the patch as soon
as possible.

==================
CVSSv3 calculation
==================
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N (3.9)

==========
Workaround
==========

Sanitize hostname input

=======
Credits
=======

Originally reported by Vinci (https://github.com/vin01).
Patches provided by Norbert Pocs of the libssh team.

==========================================================
== The libssh team
==========================================================

Incidentally, NIST NVD's current CVSS 3.1 score for OpenSSH's
CVE-2023-51385 is a ridiculous 9.8.  Quite usual for CVSS and NVD.

There's a blog post on exploitation via git submodules and on
"Vulnerable usage out in the wild" here:

https://vin01.github.io/piptagole/ssh/security/openssh/libssh/remote-code-execution/2023/12/20/openssh-proxycommand-libssh-rce.html

Alexander

<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->

<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->

By Date

By Thread

Current thread:

CVE-2023-51385, CVE-2023-6004: OpenSSH, libssh: Security weakness in ProxyCommand handling Solar Designer (Dec 26)

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->