Hi!
On 2025-05-09 18:15, Alan Coopersmith wrote:
https://lists.ucc.gu.uwa.edu.au/pipermail/dropbear/2025q2/002385.html
announces the release of Dropbear SSH 2025.88 including this fix:
- Security: Don't allow dbclient hostname arguments to be interpreted
by the shell.
dbclient hostname arguments with a comma (for multihop) would be
passed to the shell which could result in running arbitrary shell
commands locally. That could be a security issue in situations
where dbclient is passed untrusted hostname arguments.
Now the multihop command is executed directly, no shell is involved.
Thanks to Marcin Nowak for the report, tracked as CVE-2025-47203
I'm currently triaging CVE-2025-47203 to determine whether an embedded
system we maintain is actually affected. It runs 2024.86, and is built
with DROPBEAR_CLI_PROXYCMD and DROPBEAR_CLI_MULTIHOP enabled.
However, despite attempting various multihop hostname inputs containing
shell metacharacters (e.g. semicolons, backticks, pipes, $(cmd)), I’ve
been unable to trigger any shell execution or command injection. All
such inputs are interpreted literally as hostnames.
I have two main questions:
1. Is there a reliable way to confirm from the command line whether I'm
vulnerable?
2. Both dbclient and ssh are symlinks to the same dropbear binary. Does
this CVE apply equally to both, or is it specific to dbclient?
Thanks in advance,
Albert
