Re: Dropbear SSH 2025.88 fixes CVE-2025-47203

[Albert Veli <albert.veli () gmail com>]

Hi!

On 2025-05-09 18:15, Alan Coopersmith wrote:
> https://lists.ucc.gu.uwa.edu.au/pipermail/dropbear/2025q2/002385.html
> announces the release of Dropbear SSH 2025.88 including this fix:
>
> > - Security: Don't allow dbclient hostname arguments to be interpreted
> >   by the shell.
> >
> >   dbclient hostname arguments with a comma (for multihop) would be
> >   passed to the shell which could result in running arbitrary shell
> >   commands locally. That could be a security issue in situations
> >   where dbclient is passed untrusted hostname arguments.
> >
> >   Now the multihop command is executed directly, no shell is involved.
> >   Thanks to Marcin Nowak for the report, tracked as CVE-2025-47203

I'm currently triaging CVE-2025-47203 to determine whether an embedded 
system we maintain is actually affected. It runs 2024.86, and is built 
with DROPBEAR_CLI_PROXYCMD and DROPBEAR_CLI_MULTIHOP enabled.

However, despite attempting various multihop hostname inputs containing 
shell metacharacters (e.g. semicolons, backticks, pipes, $(cmd)), I’ve 
been unable to trigger any shell execution or command injection. All 
such inputs are interpreted literally as hostnames.

I have two main questions:

1. Is there a reliable way to confirm from the command line whether I'm 
vulnerable?

2. Both dbclient and ssh are symlinks to the same dropbear binary. Does 
this CVE apply equally to both, or is it specific to dbclient?

Thanks in advance,

Albert