CVE-2023-6004: Libssh: proxycommand/proxyjump features allow injection of malicious code through hostname
A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter.
Other sources
libssh could allow a local authenticated attacker to execute arbitrary commands on the system, caused by a flaw in the ProxyCommand handling. By sending a specially crafted request using hostname in expanded proxycommand, an attacker could exploit this vulnerability to execute arbitrary commands on the system.
— IBM
Libssh: proxycommand/proxyjump features allow injection of malicious code through hostname
— Microsoft
Using the ProxyCommand or the ProxyJump feature enables users to exploit unchecked hostname syntax on the client, which enables to inject malicious code into the command of the above-mentioned features through the hostname parameter.
User interaction is required to exploit this issue.
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6004?
CVE-2023-6004 is considered a critical security vulnerability due to its potential to allow arbitrary code execution.
How do I fix CVE-2023-6004?
To fix CVE-2023-6004, upgrade libssh to versions 0.9.8, 0.10.6 or higher, as specified in the remediation guidelines.
What are the potential impacts of exploiting CVE-2023-6004?
Exploiting CVE-2023-6004 may allow an attacker to inject and execute malicious commands through the hostname parameter.
Which software is affected by CVE-2023-6004?
CVE-2023-6004 affects libssh versions below 0.9.8 and 0.10.6, as well as various IBM MQ products and container images.
Where can I find more details about CVE-2023-6004?
Detailed information about CVE-2023-6004 can typically be found in security advisory bulletins released by the vendors.