// For flags

CVE-2023-51385

openssh: potential command injection via shell metacharacters

Severity Score

6.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

23
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name.

En ssh en OpenSSH anterior a 9.6, la inyección de comandos del sistema operativo puede ocurrir si un nombre de usuario o nombre de host tiene metacaracteres de shell, y un token de expansión hace referencia a este nombre en ciertas situaciones. Por ejemplo, un repositorio Git que no es de confianza puede tener un submódulo con metacaracteres de shell en un nombre de usuario o nombre de host.

A flaw was found in OpenSSH. In certain circumstances, a remote attacker may be able to execute arbitrary OS commands by using expansion tokens, such as %u or %h, with user names or host names that contain shell metacharacters.

USN-6560-1 fixed several vulnerabilities in OpenSSH. This update provides the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. Fabian Bäumer, Marcus Brinkmann, Joerg Schwenk discovered that the SSH protocol was vulnerable to a prefix truncation attack. If a remote attacker was able to intercept SSH communications, extension negotiation messages could be truncated, possibly leading to certain algorithms and features being downgraded. This issue is known as the Terrapin attack. This update adds protocol extensions to mitigate this issue.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2023-12-18 CVE Reserved
  • 2023-12-18 CVE Published
  • 2023-12-25 First Exploit
  • 2024-08-02 CVE Updated
  • 2025-08-04 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CAPEC
References (36)
URL Tag Source
http://seclists.org/fulldisclosure/2024/Mar/21 Mailing List
http://www.openwall.com/lists/oss-security/2023/12/26/4 Mailing List
https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html Mailing List
https://security.netapp.com/advisory/ntap-20240105-0005
https://support.apple.com/kb/HT214084
https://vin01.github.io/piptagole/ssh/security/openssh/libssh/remote-code-execution/2023/12/20/openssh-proxycommand-libssh-rce.html Third Party Advisory
https://www.openssh.com/txt/release-9.6 Release Notes
https://www.openwall.com/lists/oss-security/2023/12/18/2 Mailing List
URL Date SRC
https://github.com/WOOOOONG/CVE-2023-51385 2024-01-02
https://github.com/MiningBot-eth/CVE-2023-51385-exploit 2024-06-15
https://github.com/julienbrs/exploit-CVE-2023-51385 2024-01-03
https://github.com/julienbrs/malicious-exploit-CVE-2023-51385 2024-01-03
https://github.com/Le1a/CVE-2023-51385 2023-12-26
https://github.com/thinkliving2020/CVE-2023-51385- 2024-04-16
https://github.com/farliy-hacker/CVE-2023-51385 2024-01-20
https://github.com/farliy-hacker/CVE-2023-51385-save 2024-01-20
https://github.com/2048JiaLi/CVE-2023-51385 2024-01-30
https://github.com/Sonicrrrr/CVE-2023-51385 2024-01-09
https://github.com/FeatherStark/CVE-2023-51385 2023-12-25
https://github.com/c0deur/CVE-2023-51385 2024-05-27
https://github.com/vin01/poc-proxycommand-vulnerable 2024-10-24
https://github.com/watarium/poc-cve-2023-51385 2023-12-25
https://github.com/LtmThink/CVE-2023-51385_test 2024-04-15
https://github.com/WLaoDuo/CVE-2023-51385_poc-test 2023-12-26
https://github.com/power1314520/CVE-2023-51385_test 2023-12-30
https://github.com/endasugrue/CVE-2023-51385_poc 2024-06-12
https://github.com/Featherw1t/CVE-2023-51385_test 2024-08-20
https://github.com/GroundCTL2MajorTom/CVE-2023-51385POC 2025-01-06
https://github.com/GanReality/CVE-2023-51385Test 2025-06-10
https://github.com/saarcastified/CVE-2023-51385---OpenSSH-ProxyCommand-Injection-PoC 2025-07-22
https://github.com/runooovb/CVE-2023-51385test 2025-07-22
URL Date SRC
https://github.com/openssh/openssh-portable/commit/7ef3787c84b6b524501211b11a26c742f829af1a 2024-03-13
URL Date SRC
https://security.gentoo.org/glsa/202312-17 2024-03-13
https://www.debian.org/security/2023/dsa-5586 2024-03-13
https://access.redhat.com/security/cve/CVE-2023-51385 2024-03-19
https://bugzilla.redhat.com/show_bug.cgi?id=2255271 2024-03-19
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Openbsd
Search vendor "Openbsd"
 Openssh
Search vendor "Openbsd" for product "Openssh"
 < 9.6
Search vendor "Openbsd" for product "Openssh" and version " < 9.6"
-
Affected
Debian
Search vendor "Debian"
 Debian Linux
Search vendor "Debian" for product "Debian Linux"
 10.0
Search vendor "Debian" for product "Debian Linux" and version "10.0"
-
Affected
Debian
Search vendor "Debian"
 Debian Linux
Search vendor "Debian" for product "Debian Linux"
 11.0
Search vendor "Debian" for product "Debian Linux" and version "11.0"
-
Affected
Debian
Search vendor "Debian"
 Debian Linux
Search vendor "Debian" for product "Debian Linux"
 12.0
Search vendor "Debian" for product "Debian Linux" and version "12.0"
-
Affected