OpenSSH Command Injection Vulnerability via Shell Metacharacters in Usernames

A command injection vulnerability has been identified in OpenSSH versions prior to 10.3. This issue arises when shell metacharacters are included in usernames on the command line, allowing for arbitrary command execution. The vulnerability requires that the username is untrusted and that specific non-default configurations are applied in ssh_config.

Impact

Exploitation of this vulnerability could lead to unauthorized command execution on the server.

Reproduction

To reproduce this vulnerability, first ensure that OpenSSH is running a version prior to 10.3. Then, configure ssh_config to include a Match exec block that uses the %u token. Finally, execute the ssh command while passing a username that contains shell metacharacters. The injected commands will be executed on the server.

Remediation

Users are advised to update to OpenSSH version 10.3 or later, where this vulnerability has been addressed.