abraxas/sqlite-rsync-sshSQLite 3.53.4 sqlite3_rsync - High - Remote - RCE - SSH filename command injection
abraxaslabs.tech · github.com/abraxas · @abraxas_null · [email protected] · sqlite-rsync-ssh
Class: RCE (command injection) Reach: Remote (UI:R)
SQLite 3.53.4 (b09c88c) sqlite3_rsync quotes USER@HOST:PATH for local /bin/sh -c. OpenSSH then space-joins the remote argv for the login shell without those quotes. A semicolon, $(), backtick, or | in PATH runs as the SSH remote UID. Util, not libsqlite3. Ada Logics readPow2 x>16 stack smash is closed on this pin.
| ID | no CVE yet |
| Class | RCE (command injection as the SSH remote UID) |
| Reach | Remote (victim runs sqlite3_rsync; UI:R) |
| CWE | CWE-78 |
| CVSS | High: 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| Product | SQLite sqlite3_rsync util |
| Affected | 3.53.4 (b09c88c14082339b66c7b7158d609a771e64ca69, SOURCE_ID 2026-07-24 19:02:57 bf7c7f30031888f4e796e429ab3978879485813aaca6f641c7b33e4e09459bcc) |
| Auth | victim runs sqlite3_rsync with a hostile USER@HOST:PATH |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1:18910 only. Echo witness. No reverse shell. |
Put ;, $(), backticks, or | in the remote path of sqlite3_rsync USER@HOST:PATH. The victim must run the util (UI:R). The extra command runs as the SSH remote UID.
append_escaped_arg(..., 1) single-quotes for local /bin/sh -c. Those quotes are consumed locally. OpenSSH concatenates remaining argv into one remote command string. The login shell sees the metacharacters unquoted.
This is not libsqlite3. Default sqlite3.c does not ship this protocol. The Ada Logics replica stack smash (readPow2 exponent cap) is already closed on 3.53.4.
Twenty source hunts of SQLite tag version-3.53.4 after the 3.53.2 FTS5 / session wave. Default library still has other leftovers (this pack is the rsync util). tool/sqlite3_rsync.c popen2 execs /bin/sh -c. hostSeparator splits on the first colon. append_escaped_arg return is never checked.
Wrong turns: treating the Ada Logics stack smash as still open; labbing a reverse shell; talking to a real sshd; pinning draft 3.54.0; calling this a library RCE.
cd lab
./run.sh
Builds sqlite3_rsync from the official 3.53.4 source zip. Fake OpenSSH joins argv after dest. Origin lab@host:;echo SQLITE-RSYNC-SSH-WITNESS>/work/sandbox/pwned.txt. Remote command had unquoted ;echo. Bind loopback.
SUCCESS sqlite-rsync-ssh how=openssh-argv-join dest=lab@host remote-has-semicolon=yes SQLITE-RSYNC-SSH-WITNESS
Hex-encode filenames sent to the peer (isFilename==2 / --encoded-filenames) the way trunk b0db2db (2026-10-07, ANT-2026-31X9HVRR) does after this GA. USER@HOST and --ssh stay local-sh quoting. Do not rely on local single quotes surviving OpenSSH argv join.
b09c88c14082339b66c7b7158d609a771e64ca69)append_escaped_arg, popen2, remote ORIGIN/REPLICA SSH argvb0db2db / Fossil eaec2f7f (2026-10-07)