SSH ProxyCommand == unexpected code execution (CVE-2023-51385)

Post by vin10 » Mon, Dec 25, 2023, 10:29 AM UTC

Funnnny wrote: post #4

cwillu wrote: post #2

From the OpenSSH update: “Although we believe it is the user's responsibility to ensure validity of arguments passed to ssh(1), especially across a security boundary such as the git example above, OpenSSH 9.6 now bans most shell metacharacters from user and hostnames supplied via the command-line. This countermeasure is not guaranteed to be effective in all situations, as it is infeasible for ssh(1) to universally fi…

> but honestly it's not far off that level of “well, duh” I think the real problem is that other apps do use ssh and malicious actors can inject untrusted input without the user's consent. The git POC is one example, and while I do think that git also needs to be updated, fixing the problem on the ssh side is also a good idea

Post by [deleted] » Mon, Dec 25, 2023, 2:38 PM UTC

vin10 wrote: post #11

Funnnny wrote: post #4

Earlier quoted context omitted.

> but honestly it's not far off that level of “well, duh” I think the real problem is that other apps do use ssh and malicious actors can inject untrusted input without the user's consent. The git POC is one example, and while I do think that git also needs to be updated, fixing the problem on the ssh side is also a good idea

OP here. Another interesting attack vector I have been working on is OSC 8 for hyperlink support in terminals. Mostly they allow arbitrary url schemes including "ssh://" without any prompt or user interaction to consent to open an external tool like ssh client in this case. A good discussion on this: https://gist.github.com/egmontkob/eb114294efbcd5adb1944c9f3c...

Post by zeroimpl » Mon, Dec 25, 2023, 6:02 PM UTC

bdd8f1df777b wrote: post #14

zeroimpl wrote: post #7

Earlier quoted context omitted.

Try ProxyJump instead - it’s the newer way of doing it.

ProxyJump is to connect to one SSH server by another SSH, right? It doesn't work against GFW. GFW throttles SSH traffic across borders to ensure that SSH can only be used for running commands rather than tunneling data.