Vulnerability identifier: #VU84789

Vulnerability risk: Medium

CVSSv3.1: 6.7 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2023-51385

CWE-ID: CWE-78

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
OpenSSH
Server applications / Remote management servers, RDP, SSH

Vendor: OpenSSH

Description

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation when processing user names, if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. A remote attacker can execute arbitrary OS commands via an untrusted Git repository.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

OpenSSH: 9.0p1 - 9.5p1

---

External links
http://www.openssh.com/txt/release-9.6
http://www.openwall.com/lists/oss-security/2023/12/18/2
http://github.com/openssh/openssh-portable/commit/7ef3787c84b6b524501211b11a26c742f829af1a
http://www.debian.org/security/2023/dsa-5586
http://vin01.github.io/piptagole/ssh/security/openssh/libssh/remote-code-execution/2023/12/20/openssh-proxycommand-libssh-rce.html
http://lists.debian.org/debian-lts-announce/2023/12/msg00017.html
http://www.openwall.com/lists/oss-security/2023/12/26/4

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.