[Bug 1998] New: Arbitrary command execution using SCP

[bugzilla-daemon at bugzilla.mindrot.org]

https://bugzilla.mindrot.org/show_bug.cgi?id=1998

             Bug #: 1998
           Summary: Arbitrary command execution using SCP
    Classification: Unclassified
           Product: Portable OpenSSH
           Version: 5.8p1
          Platform: All
        OS/Version: Linux
            Status: NEW
          Severity: security
          Priority: P2
         Component: scp
        AssignedTo: unassigned-bugs at mindrot.org
        ReportedBy: vitja.makarov at gmail.com


Hi!

I'm not sure is that a bug or a future. Since SCP doesn't escape
filenames it's possible to execute an arbitrary command:

localhost:~$ scp 'mchome:foo;echo 123 > foo' /tmp/foo
scp: foo: No such file or directory
localhost:~$ scp 'mchome:foo;echo 123 > foo' /tmp/foo
foo                                                                    
            100%    4     0.0KB/s   00:00    
localhost:~$ cat /tmp/foo
123


I've traced it and it seems to me that scp is executing the following
command on remote side:

scp -f -- foo;echo 123 > foo

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.