cve/2023/CVE-2023-51385.md

CVE-2023-51385

Description

In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name.

POC

Reference

• https://vin01.github.io/piptagole/ssh/security/openssh/libssh/remote-code-execution/2023/12/20/openssh-proxycommand-libssh-rce.html

Github

• https://github.com/2048JiaLi/CVE-2023-51385
• https://github.com/FeatherStark/CVE-2023-51385
• https://github.com/GitHubForSnap/openssh-server-gael
• https://github.com/GoodPeople-ZhangSan/CVE-2023-51385_test
• https://github.com/Le1a/CVE-2023-51385
• https://github.com/LtmThink/CVE-2023-51385_test
• https://github.com/Marco-zcl/POC
• https://github.com/N0rther/CVE-2023-51385_TT
• https://github.com/Sonicrrrr/CVE-2023-51385
• https://github.com/Tachanka-zz/CVE-2023-51385_test
• https://github.com/WLaoDuo/CVE-2023-51385_poc-test
• https://github.com/WOOOOONG/CVE-2023-51385
• https://github.com/d4n-sec/d4n-sec.github.io
• https://github.com/farliy-hacker/CVE-2023-51385
• https://github.com/farliy-hacker/CVE-2023-51385-save
• https://github.com/firatesatoglu/iot-searchengine
• https://github.com/juev/links
• https://github.com/julienbrs/exploit-CVE-2023-51385
• https://github.com/julienbrs/malicious-exploit-CVE-2023-51385
• https://github.com/kherrick/lobsters
• https://github.com/nomi-sec/PoC-in-GitHub
• https://github.com/power1314520/CVE-2023-51385_test
• https://github.com/tanjiti/sec_profile
• https://github.com/testing-felickz/docker-scout-demo
• https://github.com/thinkliving2020/CVE-2023-51385-
• https://github.com/vin01/poc-proxycommand-vulnerable
• https://github.com/watarium/poc-cve-2023-51385
• https://github.com/wjlin0/poc-doc
• https://github.com/wy876/POC
• https://github.com/xingchennb/POC-
• https://github.com/zls1793/CVE-2023-51385_test