CVE-2023-51385

openssh: potential command injection via shell metacharacters

Severity Score

6.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name.

En ssh en OpenSSH anterior a 9.6, la inyección de comandos del sistema operativo puede ocurrir si un nombre de usuario o nombre de host tiene metacaracteres de shell, y un token de expansión hace referencia a este nombre en ciertas situaciones. Por ejemplo, un repositorio Git que no es de confianza puede tener un submódulo con metacaracteres de shell en un nombre de usuario o nombre de host.

A flaw was found in OpenSSH. In certain circumstances, a remote attacker may be able to execute arbitrary OS commands by using expansion tokens, such as %u or %h, with user names or host names that contain shell metacharacters.

*Credits: N/A

CVSS Scores

NISTv3.1 6.5

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2023-12-18 CVE Reserved
2023-12-18 CVE Published
2023-12-25 First Exploit
2024-03-08 EPSS Updated
2024-08-02 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CAPEC

References (25)

URL	Tag	Source
http://seclists.org/fulldisclosure/2024/Mar/21	Mailing List
http://www.openwall.com/lists/oss-security/2023/12/26/4	Mailing List
https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html	Mailing List
https://security.netapp.com/advisory/ntap-20240105-0005
https://support.apple.com/kb/HT214084
https://vin01.github.io/piptagole/ssh/security/openssh/libssh/remote-code-execution/2023/12/20/openssh-proxycommand-libssh-rce.html	Third Party Advisory
https://www.openssh.com/txt/release-9.6	Release Notes
https://www.openwall.com/lists/oss-security/2023/12/18/2	Mailing List

URL	Date	SRC
https://github.com/WOOOOONG/CVE-2023-51385	2024-01-02
https://github.com/MiningBot-eth/CVE-2023-51385-exploit	2024-06-15
https://github.com/julienbrs/exploit-CVE-2023-51385	2024-01-03
https://github.com/julienbrs/malicious-exploit-CVE-2023-51385	2024-01-03
https://github.com/Le1a/CVE-2023-51385	2023-12-26
https://github.com/thinkliving2020/CVE-2023-51385-	2024-04-16
https://github.com/farliy-hacker/CVE-2023-51385	2024-01-20
https://github.com/farliy-hacker/CVE-2023-51385-save	2024-01-20
https://github.com/2048JiaLi/CVE-2023-51385	2024-01-30
https://github.com/Sonicrrrr/CVE-2023-51385	2024-01-09
https://github.com/FeatherStark/CVE-2023-51385	2023-12-25
https://github.com/c0deur/CVE-2023-51385	2024-05-27

URL	Date	SRC
https://github.com/openssh/openssh-portable/commit/7ef3787c84b6b524501211b11a26c742f829af1a	2024-03-13

URL	Date	SRC
https://security.gentoo.org/glsa/202312-17	2024-03-13
https://www.debian.org/security/2023/dsa-5586	2024-03-13
https://access.redhat.com/security/cve/CVE-2023-51385	2024-03-19
https://bugzilla.redhat.com/show_bug.cgi?id=2255271	2024-03-19

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Openbsd Search vendor "Openbsd"		Openssh Search vendor "Openbsd" for product "Openssh"				< 9.6 Search vendor "Openbsd" for product "Openssh" and version " < 9.6"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				11.0 Search vendor "Debian" for product "Debian Linux" and version "11.0"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				12.0 Search vendor "Debian" for product "Debian Linux" and version "12.0"		-		Affected