OpenSSH Code Execution Vulnerability via SSH URI ProxyCommand Injection

A vulnerability in OpenSSH versions prior to 10.1 allows the inclusion of the null character in ssh:// URIs. This could lead to code execution when a ProxyCommand is utilized, as it may enable the injection of shell commands that are executed when the proxy command is initiated.

Impact

Exploitation of this vulnerability could result in arbitrary code execution on the host where the SSH client is running.

Reproduction

To reproduce this vulnerability, construct an SSH command that includes a username or an ssh:// URI obtained from an untrusted source. Ensure that a ProxyCommand is configured to use the %u expansion, which will replace %u with the username. The injected shell expressions will be executed when the proxy command is invoked.

Remediation

Users should upgrade to OpenSSH 10.1 or later, where this vulnerability has been addressed.