Open-Source Security Intelligence

Know every vulnerability
before it knows you.

DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.

Checkout DevGuardView on GitHub
Search

GHSA-7hpf-g48v-hw3j

Published Nov 12, 2024·Last modified Nov 19, 2024
Affected Components(0)

No affected components available

Description

Summary

A command injection vulnerability in the Web SSH feature allows an authenticated attacker to execute arbitrary commands as root on the host.

Details

Zoraxy has a Web SSH terminal feature that allows authenticated users to connect to SSH servers from their browsers. In HandleCreateProxySession the request to create an SSH session is handled. After checking for the presence of required parameters, ensuring that the target is not the loopback interface and that there is actually an SSH service running on the target, CreateNewConnection is called:

https://github.com/tobychui/zoraxy/blob/e79a70b7acfa45c2445aff9d60e4e7525c89fec8/src/mod/sshprox/sshprox.go#L165-L178

In line 178, the gotty binary is executed running sshCommand from the line above. It contains the user-controlled variable connAddr, which includes the hostname of the SSH server and - if provided - the username. An attacker can exploit the username variable to escape from the bash command and inject arbitrary commands into sshCommand. This is possible, because, unlike hostname and port, the username is not validated or sanitized.

This vulnerability was introduced in https://github.com/tobychui/zoraxy/commit/c07d5f85dfc37bd32819358ed7d4bc32c604e8f0. If Zoraxy is run without authentication of the management interface (started with-noauth), this vulnerability can be exploited without authentication. Additionally, if Zoraxy is run in Docker with the Docker socket mounted (as described in https://github.com/tobychui/zoraxy/blob/9cb315ea6739d1cc201b690322d25166b12dc5db/docker/README.md), this vulnerability can be exploited to escape the Zoraxy container and gain access to the Docker host.

PoC

  1. Download and run Zoraxy as described in the README
  2. Setup a user
  3. Login as user
  4. Navigate to Other -> Network Tools -> Connection
  5. Enter hostname / IP of any server with SSH running, e.g. github.com
  6. Enter ; bash ; as user
  7. Click Connect using SSH
  8. A window will open with bash running on the Zoraxy host

Demo:

https://github.com/user-attachments/assets/5a3d8771-167f-4a79-8665-ed0dfb490181

Impact

This vulnerability allows an authenticated attacker to gain remote code execution with the privileges of the Zoraxy process (root by default). This affects Zoraxy versions 2.6.1 through 3.1.2.

Risk Scores
Base Score
0.0

The vulnerability can be exploited over the network without needing physical access. It is easy for an attacker to exploit this vulnerability. An attacker needs high-level or administrative privileges. No user interaction is needed for the attacker to exploit this vulnerability. The impact is confined to the system where the vulnerability exists.

Threat Intelligence
0.0

No exploitation activity has been observed at this time. Continue routine monitoring.

EPSS
1.44%

The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.

Exploit
Not available

We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.

Related Vulnerabilities
Scan your project

Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.

Checkout DevGuard