cve/2023/CVE-2023-51385.md

### [CVE-2023-51385](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-51385)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name.

### POC

#### Reference
- https://vin01.github.io/piptagole/ssh/security/openssh/libssh/remote-code-execution/2023/12/20/openssh-proxycommand-libssh-rce.html

#### Github
- https://github.com/2048JiaLi/CVE-2023-51385
- https://github.com/FeatherStark/CVE-2023-51385
- https://github.com/GitHubForSnap/openssh-server-gael
- https://github.com/GoodPeople-ZhangSan/CVE-2023-51385_test
- https://github.com/Le1a/CVE-2023-51385
- https://github.com/LtmThink/CVE-2023-51385_test
- https://github.com/Marco-zcl/POC
- https://github.com/N0rther/CVE-2023-51385_TT
- https://github.com/Sonicrrrr/CVE-2023-51385
- https://github.com/Tachanka-zz/CVE-2023-51385_test
- https://github.com/WLaoDuo/CVE-2023-51385_poc-test
- https://github.com/WOOOOONG/CVE-2023-51385
- https://github.com/d4n-sec/d4n-sec.github.io
- https://github.com/farliy-hacker/CVE-2023-51385
- https://github.com/farliy-hacker/CVE-2023-51385-save
- https://github.com/firatesatoglu/iot-searchengine
- https://github.com/juev/links
- https://github.com/julienbrs/exploit-CVE-2023-51385
- https://github.com/julienbrs/malicious-exploit-CVE-2023-51385
- https://github.com/kherrick/lobsters
- https://github.com/nomi-sec/PoC-in-GitHub
- https://github.com/power1314520/CVE-2023-51385_test
- https://github.com/tanjiti/sec_profile
- https://github.com/testing-felickz/docker-scout-demo
- https://github.com/thinkliving2020/CVE-2023-51385-
- https://github.com/vin01/poc-proxycommand-vulnerable
- https://github.com/watarium/poc-cve-2023-51385
- https://github.com/wjlin0/poc-doc
- https://github.com/wy876/POC
- https://github.com/xingchennb/POC-
- https://github.com/zls1793/CVE-2023-51385_test