CVE-2024-34713
sshproxy vulnerable to SSH option injection
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
sshproxy vulnerable to SSH option injection
| Assigner | GitHub_M |
| Reserved | 2024-05-07 |
| Published | 2024-05-14 |
| Updated | 2024-08-02 |
sshproxy is used on a gateway to transparently proxy a user SSH connection on the gateway to an internal host via SSH. Prior to version 1.6.3, any user authorized to connect to a ssh server using `sshproxy` can inject options to the `ssh` command executed by `sshproxy`. All versions of `sshproxy` are impacted. The problem is patched starting in version 1.6.3. The only workaround is to use the `force_command` option in `sshproxy.yaml`, but it's rarely relevant.
| CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N |
CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
https://github.com/cea-hpc/sshproxy/security/advisories/GHSA-jmqp-37m5-49wh
https://github.com/cea-hpc/sshproxy/commit/f7eabd05d5f0f951e160293692327cad9a7d9580
