#!/usr/bin/env bash # ============================================================================== # SYNOPSIS # Detects system exposure to CVE-2025-61984 OpenSSH ProxyCommand vulnerability. # # DESCRIPTION # Analyzes OpenSSH installation version and SSH configuration files to assess # potential exposure to CVE-2025-61984, a command injection vulnerability in # OpenSSH's ProxyCommand feature that affects versions before 10.1. # VARIABLES TO DEFINE: # # None required - script auto-detects system configuration # WARNINGS: # # May require root privileges for complete system-wide config inspection # # Checks both system-wide and user-specific SSH configurations # # EXECUTION # chmod +x ./cve-2025-61984-detect.sh && ./cve-2025-61984-detect.sh # bash ./cve-2025-61984-detect.sh # # DISCLAIMER # VICARIUS STRONGLY RECOMMENDS RUNNING THIS SCRIPT IN A TEST LAB ENVIRONMENT # BEFORE DEPLOYING IT TO PRODUCTION. USE AT YOUR OWN DISCRETION ONLY AFTER # CAREFULLY ANALYZING THE CODE. # # AUTHOR # This script has been made by Vicarius Research Team # # VERSION # 1.0 # ============================================================================== # TAG CONFIGURATION TAG_INFO="[Info]" TAG_SAFE="[Safe]" TAG_RISK="[Potential Risk]" TAG_WARN="[Warning]" TAG_ERR="[Error]" # Status function write_status() { local message="$1" local level="${2:-Info}" case "$level" in Info) echo "$TAG_INFO $message" ;; Safe) echo "$TAG_SAFE $message" ;; Risk) echo "$TAG_RISK $message" ;; Warning) echo "$TAG_WARN $message" ;; Error) echo "$TAG_ERR $message" ;; esac } write_status "CVE-2025-61984 Exposure Audit" "Info" write_status "----------------------------------" "Info" vulnerability_factors=() # OpenSSH Version Detection echo "" echo "------- OpenSSH Version Check -------" echo "" if ! command -v ssh &> /dev/null; then write_status "OpenSSH client not found on this system." "Safe" write_status "System is not exposed to CVE-2025-61984." "Safe" exit 0 fi ssh_version=$(ssh -V 2>&1 | head -n 1) write_status "Detected: $ssh_version" "Info" # Extract version number version_number=$(echo "$ssh_version" | grep -oP 'OpenSSH_\K[0-9]+\.[0-9]+' | head -n 1) if [[ -z "$version_number" ]]; then write_status "Unable to parse OpenSSH version." "Error" version_vulnerable="unknown" else write_status "OpenSSH version: $version_number" "Info" # Compare version (vulnerable if < 10.1) if awk "BEGIN {exit !($version_number < 10.1)}"; then write_status "This OpenSSH version may be affected by CVE-2025-61984." "Risk" write_status "Vulnerable version range: OpenSSH < 10.1" "Info" vulnerability_factors+=("Vulnerable OpenSSH version detected") version_vulnerable="yes" else write_status "OpenSSH version appears to be patched against CVE-2025-61984." "Safe" write_status "Vulnerable version range: OpenSSH < 10.1" "Info" version_vulnerable="no" fi fi # Check SSH Configuration Files echo "" echo "------- SSH Configuration Analysis -------" echo "" config_files=() # System-wide config if [[ -f /etc/ssh/ssh_config ]]; then config_files+=("/etc/ssh/ssh_config") fi # User-specific configs (check all users if running as root) if [[ $EUID -eq 0 ]]; then # Running as root - check all user home directories while IFS=: read -r username _ _ _ _ homedir _; do if [[ -d "$homedir/.ssh" && -f "$homedir/.ssh/config" ]]; then config_files+=("$homedir/.ssh/config") fi done < /etc/passwd else # Running as regular user - check only current user user_ssh_config="$HOME/.ssh/config" if [[ -f "$user_ssh_config" ]]; then config_files+=("$user_ssh_config") fi fi # Check /etc/ssh/ssh_config.d/ directory if [[ -d /etc/ssh/ssh_config.d ]]; then while IFS= read -r -d '' file; do config_files+=("$file") done < <(find /etc/ssh/ssh_config.d -type f -name "*.conf" -print0 2>/dev/null) fi if [[ ${#config_files[@]} -eq 0 ]]; then write_status "No SSH configuration files found." "Info" write_status "Default SSH configuration may still be vulnerable if version < 10.1." "Warning" else write_status "Found ${#config_files[@]} SSH configuration file(s) to analyze:" "Info" for config in "${config_files[@]}"; do write_status " - $config" "Info" done fi # Analyze ProxyCommand directives echo "" write_status "Analyzing ProxyCommand configurations..." "Info" unquoted_found=false proxycommand_found=false for config in "${config_files[@]}"; do if [[ ! -r "$config" ]]; then write_status "Cannot read $config (permission denied)" "Warning" continue fi # Check for ProxyCommand with %r token while IFS= read -r line; do # Skip comments and empty lines [[ "$line" =~ ^[[:space:]]*# ]] && continue [[ -z "${line// }" ]] && continue if echo "$line" | grep -qi "ProxyCommand"; then proxycommand_found=true # Check if line contains %r token if echo "$line" | grep -q "%r"; then # Check if %r is properly quoted with single quotes if echo "$line" | grep -qE "'%r'"; then write_status "Found ProxyCommand with properly quoted %r in: $config" "Safe" write_status " Line: $(echo "$line" | xargs)" "Info" else write_status "Found ProxyCommand with unquoted %r in: $config" "Risk" write_status " Line: $(echo "$line" | xargs)" "Risk" unquoted_found=true vulnerability_factors+=("Unquoted %r token in ProxyCommand configuration") fi fi fi done < "$config" done if [[ "$proxycommand_found" == false ]]; then write_status "No ProxyCommand directives found in SSH configurations." "Safe" write_status "System is not exposed via ProxyCommand to CVE-2025-61984." "Safe" elif [[ "$unquoted_found" == false ]]; then write_status "All ProxyCommand directives appear to be properly configured." "Safe" fi # Check Git Configuration for Submodule Protocol echo "" echo "------- Git Submodule Protocol Check -------" echo "" if command -v git &> /dev/null; then # Check Git config for current context and all users if running as root git_configs_to_check=() if [[ $EUID -eq 0 ]]; then # Running as root - check all users while IFS=: read -r username _ _ _ _ homedir _; do if [[ -f "$homedir/.gitconfig" ]]; then git_configs_to_check+=("$homedir/.gitconfig:$username") fi done < /etc/passwd # Also check root's config if [[ -f /root/.gitconfig ]]; then git_configs_to_check+=("/root/.gitconfig:root") fi else # Running as regular user if [[ -f "$HOME/.gitconfig" ]]; then git_configs_to_check+=("$HOME/.gitconfig:$USER") fi fi if [[ ${#git_configs_to_check[@]} -eq 0 ]]; then write_status "No Git configuration files found." "Warning" write_status "Malicious Git submodules could potentially trigger SSH connections." "Warning" if [[ "$version_vulnerable" == "yes" ]]; then vulnerability_factors+=("Git protocol restrictions not configured") fi else vulnerable_git_configs=() for config_entry in "${git_configs_to_check[@]}"; do IFS=: read -r config_file config_user <<< "$config_entry" git_protocol=$(git config --file "$config_file" protocol.allow 2>/dev/null) if [[ -z "$git_protocol" ]]; then write_status "User '$config_user': Git protocol.allow not explicitly configured." "Warning" write_status "Malicious Git submodules could potentially trigger SSH connections." "Warning" vulnerable_git_configs+=("$config_user") elif [[ "$git_protocol" == "never" ]]; then write_status "User '$config_user': Git configured to deny all protocols - provides protection." "Safe" else write_status "User '$config_user': Git protocol.allow set to: $git_protocol" "Info" if [[ "$git_protocol" != "never" ]]; then write_status "Git may allow SSH connections for submodules." "Warning" vulnerable_git_configs+=("$config_user") fi fi done if [[ ${#vulnerable_git_configs[@]} -gt 0 && "$version_vulnerable" == "yes" ]]; then vulnerability_factors+=("Git allows SSH protocol for submodules") fi fi else write_status "Git is not installed on this system." "Info" fi # Final Assessment echo "" echo "------------- Final Assessment -------------" echo "" if [[ "$version_vulnerable" == "yes" ]]; then if [[ ${#vulnerability_factors[@]} -gt 0 ]]; then write_status "ASSESSMENT: This system configuration may increase the risk of exposure to CVE-2025-61984." "Risk" write_status "Risk factors identified:" "Risk" for factor in "${vulnerability_factors[@]}"; do write_status " - $factor" "Risk" done write_status "Consider upgrading OpenSSH to version 10.1 or applying workarounds." "Risk" else write_status "ASSESSMENT: System has vulnerable OpenSSH version but no risky configurations detected." "Warning" write_status "While ProxyCommand appears safe, upgrading to OpenSSH 10.1+ is recommended." "Warning" fi elif [[ "$version_vulnerable" == "no" ]]; then write_status "ASSESSMENT: System appears to be protected against CVE-2025-61984." "Safe" write_status "OpenSSH version is outside the vulnerable range (< 10.1)." "Safe" if [[ ${#vulnerability_factors[@]} -gt 0 ]]; then write_status "Note: Configuration issues were found but are not critical due to patched version." "Info" fi else write_status "ASSESSMENT: Unable to determine vulnerability status." "Warning" write_status "Manual verification recommended." "Warning" fi write_status "Note: This assessment is based on configuration checks and may not reflect all possible attack vectors." "Info"

PoC video

Description