<story><title>Remote code execution in OpenSSH’s forwarded SSH-agent</title><url>https://blog.qualys.com/vulnerabilities-threat-research/2023/07/19/cve-2023-38408-remote-code-execution-in-opensshs-forwarded-ssh-agent</url></story><parent_chain><item><author>sullivanmatt</author><text>This sounds way worse than it is.&lt;p&gt;To be clear, the &amp;quot;remote&amp;quot; part of the code execution is that an attacker controlling your destination server can cause your &lt;i&gt;client&lt;/i&gt; to run an attacker-controlled payload, &lt;i&gt;if&lt;/i&gt; the client is forwarding their credentials (`ssh -A`). Most people don&amp;#x27;t tend to make connections to arbitrary SSH hosts, and certainly they don&amp;#x27;t do it while forwarding their credentials along.&lt;p&gt;It&amp;#x27;s a neat attack, and I applaud the Qualys team on their find, but this is not any sort of emergency situation for 99.99% of systems.</text></item></parent_chain><comment><author>gunapologist99</author><text>I beg to differ: this does &lt;i&gt;not&lt;/i&gt; sound way worse than it is. If anything, it&amp;#x27;s understating the issue.&lt;p&gt;Not only can it be exploited across a wide variety of clients across multiple platforms, but all that&amp;#x27;s required is that you&amp;#x27;re using key forwarding.&lt;p&gt;This is devastating, because it&amp;#x27;s not just that you control the destination server and steal the keys, but you can take over the user&amp;#x27;s entire workstation.&lt;p&gt;Once you&amp;#x27;ve got the user&amp;#x27;s entire workstation, you potentially have access to everything else they have, from their email, to other SSH hosts, to key loggers, to Git repos. This is about as bad as it gets, and all because someone is using Agent Forwarding.&lt;p&gt;Best of all, the victim has &lt;i&gt;no idea&lt;/i&gt; that they&amp;#x27;ve been completely compromised. They can live inside your machine for years, upgrade their sploits, and generally exfiltrate all of your secrets.&lt;p&gt;Never use agent forwarding. Just don&amp;#x27;t. &amp;quot;Agent forwarding should be enabled with caution&amp;quot; in the man page is another massive understatement. Even if you &lt;i&gt;think&lt;/i&gt; you need it, check the other responses in this thread for examples of how to work around it.</text></comment>
<story><title>Remote code execution in OpenSSH’s forwarded SSH-agent</title><url>https://blog.qualys.com/vulnerabilities-threat-research/2023/07/19/cve-2023-38408-remote-code-execution-in-opensshs-forwarded-ssh-agent</url></story><parent_chain><item><author>sullivanmatt</author><text>This sounds way worse than it is.&lt;p&gt;To be clear, the &amp;quot;remote&amp;quot; part of the code execution is that an attacker controlling your destination server can cause your &lt;i&gt;client&lt;/i&gt; to run an attacker-controlled payload, &lt;i&gt;if&lt;/i&gt; the client is forwarding their credentials (`ssh -A`). Most people don&amp;#x27;t tend to make connections to arbitrary SSH hosts, and certainly they don&amp;#x27;t do it while forwarding their credentials along.&lt;p&gt;It&amp;#x27;s a neat attack, and I applaud the Qualys team on their find, but this is not any sort of emergency situation for 99.99% of systems.</text></item></parent_chain><comment><author>TechBro8615</author><text>The attacker controlled destination server could be a compromised host, so this enables lateral movement from a deployed VM or remote dev machine into a developer laptop.</text></comment>