https://vulners.com/exploitdb/EDB-ID:39569 https://vulners.com/exploitdb/EDB-ID:39569 > By injecting xauth commands one gains limited* read/write arbitrary fil

https://vulners.com/exploitdb/EDB-ID:39569 https://vulners.com/exploitdb/EDB-ID:39569 > By injecting xauth commands one gains limited* read/write arbitrary files, information leakage or xauth-connect capabilities. These capabilities can be leveraged by an authenticated restricted user - e.g. one with the login shellconfigured as /bin/false or one with configured forced-commands - to bypass account restriction. This is generally not expected. > The injected xauth commands are performed with the effective permissions of the logged in user as the sshd already dropped its privileges. So basically setting the shell to /bin/false or something like that can be bypassed. Just block users in sshd_config