CVE-2020-15778 Command injection in n/a
Attackers can execute arbitrary commands via malicious scp destination arguments, affecting OpenSSH users relying on scp for file transfers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-15778?
CVE-2020-15778 is a high-severity command injection vulnerability in Broadcom Fabric Operating System, published on 24 Jul 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."
Weakness: CWE-78
Which versions are affected by CVE-2020-15778?
It affects 9 products.
Linux distribution packages (35)
openssh AlmaLinux:8 | All versions | 8.0p1-24.el8 |
openssh-askpass AlmaLinux:8 | All versions | 8.0p1-24.el8 |
openssh-cavs AlmaLinux:8 | All versions | 8.0p1-24.el8 |
openssh-clients AlmaLinux:8 | All versions | 8.0p1-24.el8 |
openssh-keycat AlmaLinux:8 | All versions | 8.0p1-24.el8 |
openssh-ldap AlmaLinux:8 | All versions | 8.0p1-24.el8 |
openssh-server AlmaLinux:8 | All versions | 8.0p1-24.el8 |
pam_ssh_agent_auth AlmaLinux:8 | All versions | 0.10.3-7.24.el8 |
openssh-askpass Red Hat:enterprise_linux:8::appstream | All versions | 0:8.0p1-24.el8 |
openssh-askpass-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:8.0p1-24.el8 |
openssh-cavs-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:8.0p1-24.el8 |
openssh-clients-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:8.0p1-24.el8 |
openssh-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:8.0p1-24.el8 |
openssh-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:8.0p1-24.el8 |
openssh-keycat-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:8.0p1-24.el8 |
openssh-ldap-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:8.0p1-24.el8 |
openssh-server-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:8.0p1-24.el8 |
pam_ssh_agent_auth-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:0.10.3-7.24.el8 |
openssh Red Hat:enterprise_linux:8::baseos | All versions | 0:8.0p1-24.el8 |
openssh-askpass-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:8.0p1-24.el8 |
openssh-cavs Red Hat:enterprise_linux:8::baseos | All versions | 0:8.0p1-24.el8 |
openssh-cavs-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:8.0p1-24.el8 |
openssh-clients Red Hat:enterprise_linux:8::baseos | All versions | 0:8.0p1-24.el8 |
openssh-clients-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:8.0p1-24.el8 |
openssh-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:8.0p1-24.el8 |
openssh-debugsource Red Hat:enterprise_linux:8::baseos | All versions | 0:8.0p1-24.el8 |
openssh-keycat Red Hat:enterprise_linux:8::baseos | All versions | 0:8.0p1-24.el8 |
openssh-keycat-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:8.0p1-24.el8 |
openssh-ldap Red Hat:enterprise_linux:8::baseos | All versions | 0:8.0p1-24.el8 |
openssh-ldap-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:8.0p1-24.el8 |
openssh-server Red Hat:enterprise_linux:8::baseos | All versions | 0:8.0p1-24.el8 |
openssh-server-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:8.0p1-24.el8 |
pam_ssh_agent_auth Red Hat:enterprise_linux:8::baseos | All versions | 0:0.10.3-7.24.el8 |
pam_ssh_agent_auth-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:0.10.3-7.24.el8 |
openssh Rocky Linux:8 | All versions | 0:8.0p1-24.el8 |
Products include Broadcom Fabric Operating System, Netapp A700s Firmware, Netapp Active Iq Unified Manager, Netapp Hci Compute Node, Netapp Hci Management Node, Netapp Hci Storage Node and 3 more.
How do I fix CVE-2020-15778?
No fix published yet.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2020-15778 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-15778 exists.
Public exploit code: 4 proofs of concept on GitHub.
Other vulnerabilities in Broadcom Fabric Operating System
Sources
Also known as ALPINE-CVE-2020-15778, ALSA-2024:3166, DEBIAN-CVE-2020-15778, GHSA-cvxm-8hgf-6m6m, RHSA-2024:3166, RLSA-2024:3166 and 1 more.