4 ms·

Possibly a lot of shell command interpolation going on there. What if I try to login as "bob'; rm -rf /" or some such? Is the system robust against that?

• smhenderson 7y ago
  Does bob have proper permissions to delete root? Probably not... But otherwise, yes, you can run any valid command or pipeline on the server side so rm -rf is certainly acceptable.
  • megous 7y ago
    Bob does not, but the AuthorizedKeysCommand runs as: AuthorizedKeysCommandUser root I'm pretty sure that is enough permissions to cause trouble.
    • smhenderson 7y ago
      I confess I read the article after my comment and saw that. I was just talking about standard ssh behavior. I wouldn’t use that without seriously studying it end to end. As another comment said, “seems kind of hacky”.
• Nextgrid 7y ago
  Yeah it is a bit concerning to be honest, feels hacky.
• mbrock 7y ago
  Where do you see the problematic interpolation?
  • targonca 7y ago
    keys = (f"command=\"buildsrht-shell '{b64key}'\",restrict,pty " + f"{key_type} {b64key} somebody\n") Now it depends on how b64key is sanitized.
  • megous 7y ago
    AuthorizedKeysCommand, see above
• chousuke 7y ago
  The only point I see for injection is when OpenSSH runs the AuthorizedKeysCommand. I'm pretty sure OpenSSH handles it fine.
  • megous 7y ago
    Then look at the code. You may be surprised. Looking at the escaping function, it will allow $(execute whatever you want), because it doesn't handle $. https://github.com/openssh/openssh-portable/blob/master/misc.c#L1765 https://github.com/openssh/openssh-portable/blob/master/misc... Anyway, this depends on being able to specify any username, which while possible, requires you to pass the check that user exists in the system, which will be harder. But it may still be possible if some weird PAM module is used.
    • megous 7y ago
      Changing this to use ' instead of " may fix this issue. https://github.com/openssh/openssh-portable/blob/master/misc.c#L1801 https://github.com/openssh/openssh-portable/blob/master/misc... Because then you'll end up with '$(some)' instead of "$(some)"
    • mbrock 7y ago
      I don't think that function is used other than for logging. https://github.com/openssh/openssh-portable/blob/b52c0c2e64988277a35a955a474d944967059aeb/auth2-pubkey.c#L975 https://github.com/openssh/openssh-portable/blob/b52c0c2e649... There the "command" variable is the result of the function you mention, but here the use is only for logging. The actual argv for the subprocess is the "av" argument which comes from first splitting and then replacing "%u" etc.
      • megous 7y ago
        I see. Good.