3 ms·

> People understand that reverse hacking can happen when connecting to random ssh server, right? No, actually, I've never heard of such a vector. How would tha

• krautsauer 2mo ago
  Vulnerability in your ssh client (unlikely) or terminal emulator (more common but lower reach).
  • yjftsjthsd-h 2mo ago
    Terminal emulators have, on occasion, had all kinds of interesting escape codes that I wouldn't want to expose to an attacker. Whether this is even a true "vulnerability" is somewhat a matter of opinion (in the sense that the feature works as designed, but that's maybe a bad thing).
• jerrythegerbil 2mo ago
  An ssh server would exploit a vulnerability in the ssh client when it connects. For example, openssh has both a client and server. There’s been vulnerabilities in openssh, in the client. Those vulnerabilities aren’t reachable unless you’re connecting to a server attempting to exploit you, so the risk is quite low because you know and trust most servers you’re connecting to with ssh. To sum it up: Connecting to this server is probably fine, but in doing so most people are doing something significantly riskier without realizing it.
  • teiferer 2mo ago
    > To sum it up: Connecting to this server is probably fine And what are you basing this statement on?
    • deleted 2mo ago
      [deleted]
  • applfanboysbgon 2mo ago
    There has never been a real-world OpenSSH exploit that allows a server to RCE a client that connected to it without a bunch of dubious qualifiers. Connecting to a random SSH server is much, much less dangerous than running a random binary or executing a random curl install script, both of which people do all the time, and is probably about on par with the likelihood of a random website escaping your browser's sandbox and RCEing you.
    • Oxodao 2mo ago
      If you properly set up your ssh client (No agent forwarding or X11 forwarding)
      • LoganDark 2mo ago
        Terminal, too; some escape sequences are able to perform attacks in old or buggy terminal emulators.
        • tyingq 2mo ago
          Even newer ones. Iterm2 had CVE-2026-41253 recently. Or things like Tmux.
          • LoganDark 2mo ago
            Yes, I was thinking of iTerm2. "Older" means not the latest release and "buggy" includes well-intentioned vulnerabilities.
            • tyingq 2mo ago
              Sure. 3.6.9 (which was affected) was the most recent iTerm2 when that CVE came out.
              • LoganDark 2mo ago
                Hence "or"
  • pydry 2mo ago
    theoretically a browser could have the same vulnerability and has a vastly higher attack surface. has there ever been an example of such a vulnerability in openssh?
  • ohgree 2mo ago
    Isn't this exploit vector identical to the ones we'd expect on browser-based vulnerabilities? I believe that yes, there are possible risks involved, but no significant than our casual web-surfing through the net.
• bulder 2mo ago
  Agent forwarding would be pretty big, if it for example pushed your git credentials to the remote host.
• mr_mitm 2mo ago
  Here is a recent example. Currently unpatched in Debian stable. https://www.cve.org/CVERecord?id=CVE-2026-60002 https://www.cve.org/CVERecord?id=CVE-2026-60002 As I understood this, a malicious server can change its host key somewhere during key exchange and trigger a use-after-free in the client, which might be exploitable for code execution.