CVE-2023-51385_poc-test

CVE-2023-51385 poc OpenSSH ProxyCommand RCE poc OpenSSH 9.6 コマンドインジェクションの脆弱性 poc 中国語 1.vim /.ssh/config または Windowsシステム上で C:/Users/username/.ssh/config を編集 root@kitploit: host .example.com ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p 2. git clone...

sshconfig-lint

sshconfig-lint SSH設定が変更されるあらゆる場所に対応する単一のエンジン。 sshconfig-lint は、OpenSSH クライアント設定における意味的な誤りを検出します。重複ホスト、壊れた identity パス、安全でないオプション、脆弱なアルゴリズム、ワイルドカードの順序、複雑に絡み合った Include チェーンなどです。同じルールコードをローカル、Git フック、GitHub Actions、エディタで使用できます。 プライベートブラウザプレイグラウンドを試す · インタラクティブな例で学ぶ · すべてのルールを読む...

poc-proxycommand-vulnerable

安全でない /.ssh/config による RCE ProxyCommand における %h や %p のようなトークンの使用は、SSH を使用したトンネルや接続プロキシで非常に一般的です。 脆弱な設定 root@kitploit: host .example.com ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p 注意: 私の初期評価では、'%h' シングルクォート を使用すれば回避できると思っていましたが、次のような場合でも脆弱なままのようです: root@kitploit: url = ssh://'open...

CVE-2023-51385-

安全でない /.ssh/config を介した RCE %h や %p のようなトークンの使用は、SSH.ProxyCommand を使用したトンネルと接続プロキシで非常に人気があります。 脆弱な設定 host .example.com ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p 注: 最初の評価では、一重引用符の '%h を使えば回避できると思っていましたが、次のようなものでは依然として脆弱であるようです: ssh://echo helloworld cve.txtfoo.example.com/bar 出典:...

CVE-2026-54548

kas is a setup tool for bitbake based projects. Prior to 5.4, internal SSH key setup triggered by SSHPRIVATEKEY or SSHPRIVATEKEYFILE creates /.ssh/config when no user-specific SSH configuration exists and adds a global Host rule containing StrictHostKeyChecking no. In kas/libcmds.py,...

CVE-2026-54548 kas: Persistent SSH Host Key Checking Disablement

kas is a setup tool for bitbake based projects. Prior to 5.4, internal SSH key setup triggered by SSHPRIVATEKEY or SSHPRIVATEKEYFILE creates /.ssh/config when no user-specific SSH configuration exists and adds a global Host rule containing StrictHostKeyChecking no. In kas/libcmds.py,...

CVE-2026-45695

Kopia is a cross-platform backup tool for Windows, macOS, and Linux with fast incremental backups, client-side end-to-end encryption, compression, and data deduplication. Prior to 0.23.0, Kopia's HTTP server started with --without-password accepts unauthenticated requests to /api/v1/repo/exists a...

Malicious code in @wagni_bot/web3-agent (npm)

The npm package @wagnibot/web3-agent is a supply-chain credential stealer disguised as a web3.js SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle hook...

CVE-2026-55427

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, coder config-ssh wrote server-supplied SSH settings HostnameSuffix, SSHConfigOptions into the user's /.ssh/config without sanitizing embedded newlines or...

CVE-2026-55427 Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, coder config-ssh wrote server-supplied SSH settings HostnameSuffix, SSHConfigOptions into the user's /.ssh/config without sanitizing embedded newlines or...

GO-2026-5913 Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

Coder vulnerable to SSH config injection via unsanitized server-supplied values in coder config-ssh in github.com/coder/coder...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the coder config-ssh process. An attacker can execute arbitrary commands on the local system by injecting malicious SSH configuration directives through unsanitized server-supplied values. This is only exploitable ...

OpenSSH: OpenSSH: Arbitrary command execution via shell metacharacters in username

A flaw was found in OpenSSH. This vulnerability allows a remote attacker to achieve arbitrary command execution by injecting shell metacharacters into a username provided on the command line. Exploitation requires an untrusted username and a non-default configuration of the '%' character in...

CVE-2026-35386

OpenSSH CVE-2026-35386 affects OpenSSH before 10.3. The vulnerability allows potential command execution via shell metacharacters in a username supplied on the command line, requiring an untrusted username and a non-default ssh_config with a % in use. Connected advisories (OpenSSH

CVE-2020-7182

A sshconfig expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center iMC versions: Prior to iMC PLAT 7.3 E0705P07...

Cross site scripting

A Stored Cross-Site Scripting XSS vulnerability in the SSH configuration tab in Usermin 2.001 allows remote attackers to inject arbitrary web script or HTML via the key name field while adding an authorized key...

CVE-2020-7182

A sshconfig expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center iMC versions: Prior to iMC PLAT 7.3 E0705P07...

CVE-2017-5243

The default SSH configuration in Rapid7 Nexpose hardware appliances shipped before June 2017 does not specify desired algorithms for key exchange and other important functions. As a result, it falls back to allowing ALL algorithms supported by the relevant version of OpenSSH and makes the...

Generating SSH Keys is broken (using Bitbucket Server) -- ui and config file

Please watch my short video illustrating the experience. https://www.youtube.com/watch?v=wPUAkG78BFE&feature=youtu.be Scenario 1: On MacOS X Sierra when setting up SourceTree for first time and choosing "SSH" as the authentication method, SourceTree: Should not have a URL for the Bitbucket...

Generating SSH Keys is broken (using Bitbucket Server) -- ui and config file

Please watch my short video illustrating the experience. https://www.youtube.com/watch?v=wPUAkG78BFE&feature=youtu.be Scenario 1: On MacOS X Sierra when setting up SourceTree for first time and choosing "SSH" as the authentication method, SourceTree: Should not have a URL for the Bitbucket...