CVE-2023-51385, CVE-2023-6004: OpenSSH, libssh: Security weakness in ProxyCommand handling

[Solar Designer <solar () openwall com>]

Hi,

This was previously announced as mitigated in OpenSSH 9.6:

https://www.openwall.com/lists/oss-security/2023/12/18/2

and is now known as CVE-2023-51385 described as follows:

> In ssh in OpenSSH before 9.6, OS command injection might occur if a user
> name or host name has shell metacharacters, and this name is referenced
> by an expansion token in certain situations.  For example, an untrusted
> Git repository can have a submodule with shell metacharacters in a user
> name or host name.

The corresponding libssh issue got assigned CVE-2023-6004, with their
advisory here:

https://www.libssh.org/security/advisories/CVE-2023-6004.txt

and quoted below:

> ===========================================================
> == Subject:     Security weakness in ProxyCommand handling
> ==
> == CVE ID#:     CVE-2023-6004
> ==
> == Versions:    0.10.x, 0.9.x, 0.8.x
> ==
> == Summary:     ProxyCommand/ProxyJump features enable to inject
>                 malicious code through hostname
> ==
> ===========================================================
>
> ===========
> Description
> ===========
>
> Using the ProxyCommand or the ProxyJump feature enables users to exploit
> unchecked hostname syntax on the client, which enables to inject malicious code
> into the command of the above-mentioned features through the hostname parameter.
>
> User interaction is required to exploit this issue.
>
> ==================
> Patch Availability
> ==================
>
> Patches addressing the issues have been posted to:
> https://www.libssh.org/security/
> Additionally, libssh 0.10, 0.9 have been issued
> as security releases to correct the defect.  SSH administrators are
> advised to upgrade to these releases or apply the patch as soon
> as possible.
>
> ==================
> CVSSv3 calculation
> ==================
> CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N (3.9)
>
> ==========
> Workaround
> ==========
>
> Sanitize hostname input
>
> =======
> Credits
> =======
>
> Originally reported by Vinci (https://github.com/vin01).
> Patches provided by Norbert Pocs of the libssh team.
>
> ==========================================================
> == The libssh team
> ==========================================================

Incidentally, NIST NVD's current CVSS 3.1 score for OpenSSH's
CVE-2023-51385 is a ridiculous 9.8.  Quite usual for CVSS and NVD.

There's a blog post on exploitation via git submodules and on
"Vulnerable usage out in the wild" here:

https://vin01.github.io/piptagole/ssh/security/openssh/libssh/remote-code-execution/2023/12/20/openssh-proxycommand-libssh-rce.html

Alexander