CVE-2020-15778 – OpenSSH SCP Command Injection Vulnerability (Detection Script)

About

CVE-2020-15778 is a command injection vulnerability discovered in the scp utility provided by OpenSSH (versions ≤ 8.3p1). The issue allows an attacker to execute arbitrary commands on the client system if a crafted destination argument (containing backticks) is passed to scp.

This repository includes a safe detection and simulation script written in Bash. The script helps users and system administrators:

Identify whether their system's scp version is vulnerable
Understand how the vulnerability works
Test and detect risky command inputs (e.g., arguments containing backticks)
Learn how to mitigate and avoid this vulnerability

What is CVE-2020-15778?

In OpenSSH scp, versions up to 8.3p1 do not properly sanitize destination arguments before passing them to the shell. This allows an attacker to use shell metacharacters like backticks (`) to inject arbitrary commands.

Example of a Malicious Command

scp file.txt user@host:`touch /tmp/pwned`/file.txt

In a vulnerable SCP version, this will execute touch /tmp/pwned on the client’s machine when the command runs.

Affected Versions

SCP Version	Status
≤ 8.3p1	Vulnerable
≥ 8.4p1	Not Vulnerable

Script Features

This Bash script performs the following actions:

Detects the current SCP version installed on the system
Compares it against version 8.3p1 to determine if it is vulnerable
Prompts the user to input a sample SCP destination string
Analyzes the input for unsafe patterns (such as backticks)
Displays warnings and provides guidance on mitigation

How to Use

Step 1: Clone or Download the Script

git clone https://github.com/drackyjr/CVE-2020-15778-SCP-Command-Injection-Check.git
cd scp-cve-2020-15778-checker

Step 2: Make the Script Executable

chmod +x scp_cve_check.sh

Step 3: Run the Script

./scp_cve_check.sh

CVE-2020-15778-SCP-Command-Injection-Check

Most Popular