https://bugzilla.mindrot.org/show_bug.cgi?id=2706
Bug ID: 2706
Summary: remote code execution via ProxyCommand+browser exploit
Product: Portable OpenSSH
Version: 7.4p1
Hardware: All
OS: Mac OS X
Status: NEW
Severity: security
Priority: P5
Component: ssh
Assignee: [email protected]
Reporter: [email protected]
Given the URL in a web browser:
"ssh://user@somehost.%60id%3E%2Ftmp%2Fwhoami%60.example.com"
iTerm2 currently launches ssh with a hostname of:
somehost.`id>/tmp/whoami`.example.com
With a vanilla SSH configuration this is ok since SSH errors out with
"host not found." However, with a special SSH configuration, a website
can execute an arbitrary command:
```
Host *
ProxyCommand connect_to %r %h
```
What happened:
`id>/tmp/whoami` was executed.
What should have happened instead:
1) SSH passes %r/%h as an argument to the ProxyCommand without shell
interpolation
2) %h should be validated to adhere to valid punycode
3) Introduce a SafeProxyCommand that only allows safe characters in
%r/%h/etc...
--
You are receiving this mail because:
You are watching the assignee of the bug.
_______________________________________________
openssh-bugs mailing list
[email protected]
https://lists.mindrot.org/mailman/listinfo/openssh-bugs
