Dropbear SSHD xauth Command Injection / Bypass
Posted by deepcore on March 17, 2016 – 6:17 am
Dropbear sshd versions 2015.71 and below suffer from a command injection vulnerability via xauth. An authenticated user may inject arbitrary xauth commands by sending an x11 channel request that includes a newline character in the x11 cookie. The newline acts as a command separator to the xauth binary. This attack requires the server to have ‘X11Forwarding yes’ enabled. Disabling it, mitigates this vector.
Post a reply
You must be logged in to post a comment.