OpenSSH Username Expansion Command Injection

Executive Summary

This vulnerability in OpenSSH allows special characters like '$' or a non-trailing backslash in usernames entered via the ssh command line. When configurations expand %u in ProxyCommand or Match exec, these characters are passed into the shell, enabling potential command injection. Usernames set only in configuration files are not affected.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check OpenSSH configurations for ProxyCommand or Match exec directives using %u expansion. Inspect command-line arguments for usernames containing '$' or non-trailing backslashes. Review logs for unexpected command execution or username expansion.

Useful 0 Not Useful 0

Impact Analysis

Attackers could exploit this to execute unauthorized commands on your system, leading to data theft, modification, or system disruption. It requires network access and user interaction, such as entering a malicious username via the command line.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially violate compliance requirements under GDPR and HIPAA by enabling unauthorized command execution through command injection. If exploited, attackers could access, modify, or steal sensitive data, leading to breaches of confidentiality and integrity mandated by these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Avoid using untrusted usernames on the command line when %u is expanded. Disable or restrict %u expansion in ProxyCommand or Match exec directives. Update OpenSSH to the latest patched version if available. Monitor for unusual command execution patterns.

Useful 0 Not Useful 0