Description

In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name.

INFO

Published Date :

Dec. 18, 2023, 7:15 p.m.

Last Modified :

March 13, 2024, 9:15 p.m.

Remotely Exploitable :

Yes !

Impact Score :

2.5

Exploitability Score :

3.9
Public PoC/Exploit Available at Github

CVE-2023-51385 has a 39 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2023-51385 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Debian debian_linux
1 Openbsd openssh

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

None

Updated: 1 month, 3 weeks ago
0 stars 0 fork 0 watcher
Born at : Sept. 9, 2024, 1:28 a.m. This repo has been linked 128 different CVEs too.

None

HTML

Updated: 1 month, 3 weeks ago
0 stars 0 fork 0 watcher
Born at : Sept. 4, 2024, 9:24 a.m. This repo has been linked 128 different CVEs too.

DockerLab - Machine

Updated: 2 months, 1 week ago
0 stars 0 fork 0 watcher
Born at : Aug. 24, 2024, 5:09 p.m. This repo has been linked 6 different CVEs too.

None

Updated: 2 months, 2 weeks ago
0 stars 0 fork 0 watcher
Born at : Aug. 20, 2024, 2:25 a.m. This repo has been linked 1 different CVEs too.

DockerLab - Machine

Updated: 2 months, 2 weeks ago
0 stars 0 fork 0 watcher
Born at : Aug. 19, 2024, 3:29 p.m. This repo has been linked 9 different CVEs too.

Máquina DockerLab

Updated: 2 months, 2 weeks ago
0 stars 0 fork 0 watcher
Born at : Aug. 18, 2024, 1:13 a.m. This repo has been linked 9 different CVEs too.

None

HTML

Updated: 2 months, 3 weeks ago
5 stars 0 fork 0 watcher
Born at : Aug. 2, 2024, 6:07 a.m. This repo has been linked 123 different CVEs too.

None

Updated: 4 months, 3 weeks ago
0 stars 0 fork 0 watcher
Born at : June 15, 2024, 8:27 a.m. This repo has been linked 1 different CVEs too.

None

Updated: 3 months, 1 week ago
1 stars 0 fork 0 watcher
Born at : June 14, 2024, 6:54 a.m. This repo has been linked 95 different CVEs too.

None

Updated: 4 months, 3 weeks ago
0 stars 0 fork 0 watcher
Born at : June 12, 2024, 7:41 p.m. This repo has been linked 1 different CVEs too.

None

Updated: 4 months, 3 weeks ago
0 stars 0 fork 0 watcher
Born at : June 12, 2024, 7:38 p.m. This repo has been linked 1 different CVEs too.

None

Dockerfile Go

Updated: 5 months ago
0 stars 0 fork 0 watcher
Born at : May 29, 2024, 6:54 p.m. This repo has been linked 78 different CVEs too.

None

Updated: 5 months, 1 week ago
0 stars 0 fork 0 watcher
Born at : May 27, 2024, 7:29 p.m. This repo has been linked 1 different CVEs too.

None

HTML Python

Updated: 4 months, 1 week ago
13 stars 1 fork 1 watcher
Born at : April 17, 2024, 8:46 a.m. This repo has been linked 100 different CVEs too.

CVE-2023-51385

Updated: 6 months, 2 weeks ago
0 stars 0 fork 0 watcher
Born at : April 16, 2024, 3:01 a.m. This repo has been linked 1 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2023-51385 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2023-51385 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by [email protected]

    May. 14, 2024

    Action Type Old Value New Value
  • CVE Modified by [email protected]

    Mar. 13, 2024

    Action Type Old Value New Value
    Added Reference MITRE http://seclists.org/fulldisclosure/2024/Mar/21 [No types assigned]
  • CVE Modified by [email protected]

    Mar. 07, 2024

    Action Type Old Value New Value
    Added Reference MITRE https://support.apple.com/kb/HT214084 [No types assigned]
  • CVE Modified by [email protected]

    Jan. 05, 2024

    Action Type Old Value New Value
    Added Reference MITRE https://security.netapp.com/advisory/ntap-20240105-0005/ [No types assigned]
  • Modified Analysis by [email protected]

    Jan. 03, 2024

    Action Type Old Value New Value
    Removed CVSS V3.1 NIST AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    Added CVSS V3.1 NIST AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
    Changed Reference Type http://www.openwall.com/lists/oss-security/2023/12/26/4 No Types Assigned http://www.openwall.com/lists/oss-security/2023/12/26/4 Mailing List, Third Party Advisory
    Changed Reference Type https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html No Types Assigned https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html Mailing List, Third Party Advisory
    Changed Reference Type https://security.gentoo.org/glsa/202312-17 No Types Assigned https://security.gentoo.org/glsa/202312-17 Third Party Advisory
    Changed Reference Type https://vin01.github.io/piptagole/ssh/security/openssh/libssh/remote-code-execution/2023/12/20/openssh-proxycommand-libssh-rce.html No Types Assigned https://vin01.github.io/piptagole/ssh/security/openssh/libssh/remote-code-execution/2023/12/20/openssh-proxycommand-libssh-rce.html Third Party Advisory
    Changed Reference Type https://www.debian.org/security/2023/dsa-5586 No Types Assigned https://www.debian.org/security/2023/dsa-5586 Third Party Advisory
    Added CPE Configuration OR *cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* *cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* *cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
  • CVE Modified by [email protected]

    Dec. 28, 2023

    Action Type Old Value New Value
    Added Reference MITRE https://security.gentoo.org/glsa/202312-17 [No types assigned]
  • CVE Modified by [email protected]

    Dec. 26, 2023

    Action Type Old Value New Value
    Added Reference MITRE http://www.openwall.com/lists/oss-security/2023/12/26/4 [No types assigned]
  • CVE Modified by [email protected]

    Dec. 26, 2023

    Action Type Old Value New Value
    Added Reference MITRE https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html [No types assigned]
  • CVE Modified by [email protected]

    Dec. 22, 2023

    Action Type Old Value New Value
    Added Reference MITRE https://vin01.github.io/piptagole/ssh/security/openssh/libssh/remote-code-execution/2023/12/20/openssh-proxycommand-libssh-rce.html [No types assigned]
  • CVE Modified by [email protected]

    Dec. 22, 2023

    Action Type Old Value New Value
    Added Reference MITRE https://www.debian.org/security/2023/dsa-5586 [No types assigned]
  • Initial Analysis by [email protected]

    Dec. 22, 2023

    Action Type Old Value New Value
    Added CVSS V3.1 NIST AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    Changed Reference Type https://github.com/openssh/openssh-portable/commit/7ef3787c84b6b524501211b11a26c742f829af1a No Types Assigned https://github.com/openssh/openssh-portable/commit/7ef3787c84b6b524501211b11a26c742f829af1a Patch
    Changed Reference Type https://www.openssh.com/txt/release-9.6 No Types Assigned https://www.openssh.com/txt/release-9.6 Release Notes
    Changed Reference Type https://www.openwall.com/lists/oss-security/2023/12/18/2 No Types Assigned https://www.openwall.com/lists/oss-security/2023/12/18/2 Mailing List, Release Notes
    Added CWE NIST CWE-78
    Added CPE Configuration OR *cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:* versions up to (excluding) 9.6
  • CVE Modified by [email protected]

    Dec. 19, 2023

    Action Type Old Value New Value
    Added Reference MITRE https://github.com/openssh/openssh-portable/commit/7ef3787c84b6b524501211b11a26c742f829af1a [No types assigned]
  • CVE Received by [email protected]

    Dec. 18, 2023

    Action Type Old Value New Value
    Added Description In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name.
    Added Reference MITRE https://www.openssh.com/txt/release-9.6 [No types assigned]
    Added Reference MITRE https://www.openwall.com/lists/oss-security/2023/12/18/2 [No types assigned]
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2023-51385 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Exploit Prediction

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.

0.27 }} 0.08%

score

0.66979

percentile

CVSS31 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability