CVE-2023-51385

What it actually does

OS command injection in ssh client when usernames or hostnames containing shell metacharacters are expanded via tokens such as %u or %h in certain configuration or proxy scenarios.

Why it matters to the business

Attackers can execute arbitrary operating-system commands on systems that use affected OpenSSH versions when processing untrusted data such as Git submodules, potentially leading to remote code execution, credential theft, or lateral movement with moderate urgency given stable exploitability scores and wide OpenSSH deployment.

How an attack unfolds

An attacker places shell metacharacters inside a username or hostname field of a Git submodule URL in an untrusted repository; when a victim performs operations that cause ssh to expand those tokens (for example during submodule fetch or proxy command handling), the injected characters are interpreted by the shell resulting in command execution.

How to fix it

Upgrade OpenSSH to version 9.6 or later (commit 7ef3787c84b6b524501211b11a26c742f829af1a in openssh-portable). Where immediate upgrade is not possible, avoid using untrusted Git repositories or disable expansion tokens in ssh configuration for high-risk workflows.

How to confirm the fix worked

Verify installed OpenSSH version is 9.6 or newer; test ssh client behavior with crafted usernames containing metacharacters such as backticks or semicolons in expansion contexts to confirm injection is no longer possible.

Typical attack path

1. Craft a Git repository containing a malicious .gitmodules file with shell metacharacters in user or host fields
2. Host the repository in a location reachable by the target environment
3. Trick or wait for a victim system to clone or update the repository triggering ssh expansion
4. Injected metacharacters cause the ssh client to execute attacker-controlled operating-system commands

How to detect it

Inspect ssh client logs and process creation events for unexpected shell activity immediately following Git operations or ssh connections involving external repositories; look for child processes spawned by ssh that were not present in normal operation.

What your security team should do

• Apply the OpenSSH 9.6 upgrade immediately on all affected systems
• Restrict use of untrusted Git repositories and submodule features until patched
• Review ssh configuration for any custom ProxyCommand or similar expansions that reference user or host tokens
• Monitor for post-patch anomalies in ssh-related process trees