scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."
** EN DISPUTA ** scp en OpenSSH versiones hasta 8.3p1 permite una inyección de comandos en la función toremote de scp.c, como lo demuestran los caracteres backtick en el argumento de destino. NOTA: según se informa, el proveedor ha declarado que omite intencionadamente la validación de las "transferencias de argumentos anómalos" porque eso podría "tener grandes posibilidades de romper los flujos de trabajo existentes"
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
| Attack Vector | ADJACENT_NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | REQUIRED |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
AV:N/AC:M/Au:N/C:P/I:P/A:P
| Access Vector | NETWORK |
|---|---|
| Access Complexity | MEDIUM |
| Authentication | NONE |
| Confidentiality Impact | PARTIAL |
| Integrity Impact | PARTIAL |
| Availability Impact | PARTIAL |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-78
|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary |
en
CWE-78
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| openbsd | openssh | * | <built-in method update of dict object at 0x7fd348daf9c0> | Application |
| openbsd | openssh | 8.3 | <built-in method update of dict object at 0x7fd34bce23c0> | Application |
| openbsd | openssh | 8.3 | <built-in method update of dict object at 0x7fd2d39ff0c0> | Application |
| netapp | a700s_firmware | - | <built-in method update of dict object at 0x7fd36b156040> | Operating System |
| netapp | active_iq_unified_manager | * | <built-in method update of dict object at 0x7fd369406ac0> | Application |
| netapp | hci_management_node | - | <built-in method update of dict object at 0x7fd3849fc100> | Application |
| netapp | solidfire | - | <built-in method update of dict object at 0x7fd2d39fc4c0> | Application |
| netapp | steelstore_cloud_integrated_storage | - | <built-in method update of dict object at 0x7fd34bce1b80> | Application |
| netapp | hci_compute_node | - | <built-in method update of dict object at 0x7fd34bce0d80> | Hardware |
| netapp | hci_storage_node | - | <built-in method update of dict object at 0x7fd369407740> | Hardware |
| broadcom | fabric_operating_system | - | <built-in method update of dict object at 0x7fd384aa3980> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openbsd:openssh:8.3:-:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openbsd:openssh:8.3:p1:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:a700s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:a700s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:* |
| Yes | cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:h:netapp:hci_storage_node:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:broadcom:fabric_operating_system:-:*:*:*:*:*:*:* |