Main
Vulnerability Database
Exploits
ID:9728 - Exploit for OS Command Injection in OpenSSH - CVE-2023-51385
ID:9728 - Exploit for OS Command Injection in OpenSSH - CVE-2023-51385
Published: April 19, 2024
Vulnerability identifier: #VU84789
Vulnerability risk: Medium
CVE-ID: CVE-2023-51385
CWE-ID: CWE-78
Exploitation vector: Remote access
Vulnerable software:
OpenSSH
OpenSSH
Link to public exploit:
Vulnerability description
The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.
The vulnerability exists due to improper input validation when processing user names, if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. A remote attacker can execute arbitrary OS commands via an untrusted Git repository.
Remediation
Install updates from vendor's website.