OpenSSH Vulnerability Exploited Via ProxyCommand to Execute Remote Code – PoC Released
A newly disclosed command injection vulnerability in OpenSSH, identified as CVE-2025-61984, may enable an attacker to execute remote code on a victim's system.
A newly disclosed command injection vulnerability in OpenSSH, identified as CVE-2025-61984, may enable an attacker to execute remote code on a victim's system.
This vulnerability bypasses a previous fix for a similar issue ( CVE-2023-51385 ) by exploiting the ProxyCommand feature's interaction with the system shell, particularly when processing specially crafted usernames.
The vulnerability stems from OpenSSH's inadequate sanitization of control characters, such as newlines, within usernames. An attacker can craft a username with a newline character followed by a malicious command.
This username is transmitted to the shell through SSH's ProxyCommand . Although OpenSSH filters numerous hazardous shell metacharacters, it does not filter characters that might induce a syntax error in certain shells.
When shells such as Bash, Fish, or csh process the ProxyCommand , a crafted syntax error on the first line causes the command to fail, but the shell does not exit. Instead, it executes the command on the next line, which is the attacker's malicious payload. This behavior effectively circumvents security measures designed to prevent command execution, potentially facilitating remote code execution.
The primary exploitation scenario for CVE-2025-61984 involves a malicious Git repository. An attacker can set up a submodule within their repository to use a URL that contains the malicious, multi-line username.
The vulnerability stems from OpenSSH's inadequate sanitization of control characters, such as newlines, within usernames.
Should a victim clone this repository recursively ( git clone --recursive ), Git will attempt to connect via SSH to fetch the submodule, triggering the ProxyCommand vulnerability if the user's configuration is vulnerable.
The exploit necessitates two specific conditions on the victim's machine: a shell that continues execution after a syntax error (e.g., Bash) and an SSH configuration file ( ~/.ssh/config ) with a ProxyCommand utilizing the %r token to incorporate the remote username.
It is noteworthy that the secure shell Zsh is not susceptible to this technique as it terminates upon encountering such errors. Tools like Teleport have been identified as generating SSH configurations that use this vulnerable pattern, potentially increasing the attack vector.
The OpenSSH project has issued a patch in version 10.1 that effectively addresses this vulnerability by prohibiting control characters in usernames. Users are strongly advised to upgrade to this version or later.
For systems that cannot be updated immediately, several mitigations are available.
Users can modify their SSH configurations by enclosing the %r token in single quotes ( '%r' ) within any ProxyCommand directive, which prevents the shell from interpreting the special characters. Another effective defense-in-depth strategy is to configure Git to limit the automatic use of SSH for submodules.
This vulnerability highlights the complex security risks that can arise from the interactions between trusted developer tools.
Based on reporting by Cyber Security News.