Hacker News new | ask | show | jobs
by leftcenterright 903 days ago
It does not seem as critical for public SSH servers but does seem pretty bad for ssh clients using ProxyCommand in their configurations.

I had this in my config for proxying over tor and seems like it is vulnerable.

```

ProxyCommand connect -5 -S localhost:9050 `tor-resolve %h` %p

```

https://swrdfish.github.io/2015/01/08/ssh-and-git-through-to...

1 comments

Yeah, I missed the cutoff to edit my original comment. It's quite the footgun due to the combination of a forced involvement of a shell and a built-in naive value substitution.

If ssh made the parameters available as environment variables, you could do “ProxyCommand connect -5 -S localhost:9050 "$(tor-resolve "$HOST")" "$PORT"”, which wouldn't be vulnerable to this as long as connect and tor-resolve don't themselves have similar issues with their parameter handling: $HOST could still expand to other switches on tor-resolve, but it couldn't expand to extra commands or quotemarks that bash (or whatever) would process.

Which still isn't great, but at least it would be possible to get it right with sufficient care and attention.