Command Injection Vulnerability in OpenSSH's SCP Function

CVE-2020-15778

Summary

A vulnerability in OpenSSH's SCP functionality allows attackers to perform command injection through the handling of destination arguments. Specifically, the issue arises in the scp.c toremote function, where the use of backtick characters in the destination string can lead to arbitrary command execution. The vendor has acknowledged that they intentionally omit validation of 'anomalous argument transfers' to maintain existing workflows, potentially exposing users to unwanted risks. This situation highlights a significant security concern, emphasizing the need for thorough validation in command handling within network services.

References