CVE-2024-34713

Published: May 14, 2024Modified: Jun 17, 2026Deferred

3.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Exploitability: 2.1 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

sshproxy is used on a gateway to transparently proxy a user SSH connection on the gateway to an internal host via SSH. Prior to version 1.6.3, any user authorized to connect to a ssh server using `sshproxy` can inject options to the `ssh` command executed by `sshproxy`. All versions of `sshproxy` are impacted. The problem is patched starting in version 1.6.3. The only workaround is to use the `force_command` option in `sshproxy.yaml`, but it's rarely relevant.

Related CWEs

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

References (4)

https://github.com/cea-hpc/sshproxy/commit/f7eabd05d5f0f951e160293692327cad9a7d9580

Source: security-advisories@github.com

https://github.com/cea-hpc/sshproxy/security/advisories/GHSA-jmqp-37m5-49wh

Source: security-advisories@github.com

https://github.com/cea-hpc/sshproxy/commit/f7eabd05d5f0f951e160293692327cad9a7d9580

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/cea-hpc/sshproxy/security/advisories/GHSA-jmqp-37m5-49wh

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.