CVE-2020-15778 : scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote func

scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."

Published 2020-07-24 14:15:12

Updated 2024-08-04 14:15:26

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2020-15778

Openbsd » Openssh
Versions before (<) 8.3
cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*
Matching versions
Openbsd » Openssh » Version: 8.3
cpe:2.3:a:openbsd:openssh:8.3:-:*:*:*:*:*:*
Matching versions
Openbsd » Openssh » Version: 8.3 Update P1
cpe:2.3:a:openbsd:openssh:8.3:p1:*:*:*:*:*:*
Matching versions
Broadcom » Fabric Operating System » Version: N/A
cpe:2.3:o:broadcom:fabric_operating_system:-:*:*:*:*:*:*:*
Matching versions
Netapp » Steelstore Cloud Integrated Storage » Version: N/A
cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*
Matching versions
Netapp » Hci Management Node » Version: N/A
cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*
Matching versions
Netapp » Solidfire » Version: N/A
cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*
Matching versions
Netapp » Hci Storage Node » Version: N/A
cpe:2.3:h:netapp:hci_storage_node:-:*:*:*:*:*:*:*
Matching versions
Netapp » Hci Compute Node » Version: N/A
cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*
Matching versions
Netapp » Active Iq Unified Manager » For Vmware Vsphere
Versions from including (>=) 9.5
cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:*
Matching versions
Netapp » A700s Firmware » Version: N/A
cpe:2.3:o:netapp:a700s_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » A700s » Version: N/A

Threat overview for CVE-2020-15778

Top countries where our scanners detected CVE-2020-15778

Top open port discovered on systems with this issue 22

IPs affected by CVE-2020-15778 22,214,504

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2020-15778!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2020-15778

EPSS FAQ

0.59%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 78 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-15778

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P	8.6	6.4	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	1.8	5.9	134c704f-9b21-4f2e-91b3-4a467353bcc0	2024-07-03
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2020-15778

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Assigned by:
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
- nvd@nist.gov (Primary)

References for CVE-2020-15778

https://security.netapp.com/advisory/ntap-20200731-0007/

CVE-2020-15778 OpenSSH Vulnerability in NetApp Products | NetApp Product Security
Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:3166

RHSA-2024:3166 - Security Advisory - Red Hat カスタマーポータル
https://security.gentoo.org/glsa/202212-06

OpenSSH: Multiple Vulnerabilities (GLSA 202212-06) — Gentoo security
Third Party Advisory
https://www.openssh.com/security.html

OpenSSH: Security
Vendor Advisory

CVEs referencing this url
https://news.ycombinator.com/item?id=25005567

Deprecating scp | Hacker News
Third Party Advisory
https://github.com/cpandya2909/CVE-2020-15778/

GitHub - cpandya2909/CVE-2020-15778
Exploit;Third Party Advisory