3 ms·

The only point I see for injection is when OpenSSH runs the AuthorizedKeysCommand. I'm pretty sure OpenSSH handles it fine.

• megous 7y ago
  Then look at the code. You may be surprised. Looking at the escaping function, it will allow $(execute whatever you want), because it doesn't handle $. https://github.com/openssh/openssh-portable/blob/master/misc.c#L1765 https://github.com/openssh/openssh-portable/blob/master/misc... Anyway, this depends on being able to specify any username, which while possible, requires you to pass the check that user exists in the system, which will be harder. But it may still be possible if some weird PAM module is used.
  • megous 7y ago
    Changing this to use ' instead of " may fix this issue. https://github.com/openssh/openssh-portable/blob/master/misc.c#L1801 https://github.com/openssh/openssh-portable/blob/master/misc... Because then you'll end up with '$(some)' instead of "$(some)"
  • mbrock 7y ago
    I don't think that function is used other than for logging. https://github.com/openssh/openssh-portable/blob/b52c0c2e64988277a35a955a474d944967059aeb/auth2-pubkey.c#L975 https://github.com/openssh/openssh-portable/blob/b52c0c2e649... There the "command" variable is the result of the function you mention, but here the use is only for logging. The actual argv for the subprocess is the "av" argument which comes from first splitting and then replacing "%u" etc.
    • megous 7y ago
      I see. Good.