#!/usr/bin/env bash # ============================================================================== # SYNOPSIS # Mitigates CVE-2025-61984 OpenSSH ProxyCommand vulnerability without patching. # # DESCRIPTION # Applies temporary workarounds to reduce exposure to CVE-2025-61984 by # quoting %r tokens in ProxyCommand directives and configuring Git to # restrict automatic SSH protocol usage for submodules. # VARIABLES TO DEFINE: # # None required - script auto-applies mitigations # WARNINGS: # # Requires root privileges to modify system-wide SSH configurations # # Modifies SSH config files - backup recommended before running # # Changes Git global configuration # # EXECUTION # chmod +x ./cve-2025-61984-mitigate.sh && sudo ./cve-2025-61984-mitigate.sh # sudo bash ./cve-2025-61984-mitigate.sh # # DISCLAIMER # VICARIUS STRONGLY RECOMMENDS RUNNING THIS SCRIPT IN A TEST LAB ENVIRONMENT # BEFORE DEPLOYING IT TO PRODUCTION. USE AT YOUR OWN DISCRETION ONLY AFTER # CAREFULLY ANALYZING THE CODE. # # AUTHOR # This script has been made by Vicarius Research Team # # VERSION # 1.0 # ============================================================================== # TAG CONFIGURATION TAG_INFO="[Info]" TAG_SAFE="[Safe]" TAG_RISK="[Potential Risk]" TAG_WARN="[Warning]" TAG_ERR="[Error]" TAG_SUCCESS="[Success]" # Status function write_status() { local message="$1" local level="${2:-Info}" case "$level" in Info) echo "$TAG_INFO $message" ;; Safe) echo "$TAG_SAFE $message" ;; Risk) echo "$TAG_RISK $message" ;; Warning) echo "$TAG_WARN $message" ;; Error) echo "$TAG_ERR $message" ;; Success) echo "$TAG_SUCCESS $message" ;; esac } write_status "CVE-2025-61984 Mitigation Script" "Info" write_status "----------------------------------" "Info" # Check for root privileges if [[ $EUID -ne 0 ]]; then write_status "This script requires root privileges to modify system configurations." "Warning" write_status "Some mitigations may not be applied without elevated permissions." "Warning" echo "" fi mitigation_count=0 failed_count=0 # Check if OpenSSH is installed echo "" echo "------- OpenSSH Installation Check -------" echo "" if ! command -v ssh &> /dev/null; then write_status "OpenSSH client not found on this system." "Info" write_status "No SSH-related mitigations needed." "Info" else ssh_version=$(ssh -V 2>&1 | head -n 1) write_status "Detected: $ssh_version" "Info" # SSH Configuration Mitigation echo "" echo "------- SSH Configuration Mitigation -------" echo "" config_files=() # System-wide config if [[ -f /etc/ssh/ssh_config ]]; then config_files+=("/etc/ssh/ssh_config") fi # User-specific configs (check all users if running as root) if [[ $EUID -eq 0 ]]; then # Running as root - check all user home directories while IFS=: read -r username _ _ _ _ homedir _; do if [[ -d "$homedir/.ssh" && -f "$homedir/.ssh/config" ]]; then config_files+=("$homedir/.ssh/config") fi done < /etc/passwd else # Running as regular user - check only current user user_ssh_config="$HOME/.ssh/config" if [[ -f "$user_ssh_config" ]]; then config_files+=("$user_ssh_config") fi fi # Check /etc/ssh/ssh_config.d/ directory if [[ -d /etc/ssh/ssh_config.d ]]; then while IFS= read -r -d '' file; do config_files+=("$file") done < <(find /etc/ssh/ssh_config.d -type f -name "*.conf" -print0 2>/dev/null) fi if [[ ${#config_files[@]} -eq 0 ]]; then write_status "No SSH configuration files found." "Info" write_status "Creating user SSH config with safe defaults..." "Info" # Create .ssh directory if it doesn't exist if [[ ! -d "$HOME/.ssh" ]]; then if mkdir -p "$HOME/.ssh" 2>/dev/null; then chmod 700 "$HOME/.ssh" write_status "Created $HOME/.ssh directory." "Success" else write_status "Failed to create $HOME/.ssh directory." "Error" failed_count=$((failed_count + 1)) fi fi # Create basic config with comment about CVE-2025-61984 cat > "$HOME/.ssh/config" 2>/dev/null << 'EOF' # SSH Configuration # Note: When using ProxyCommand with %r token, ensure it is quoted: '%r' # This protects against CVE-2025-61984 EOF if [[ $? -eq 0 ]]; then chmod 600 "$HOME/.ssh/config" write_status "Created $HOME/.ssh/config with CVE-2025-61984 guidance." "Success" mitigation_count=$((mitigation_count + 1)) else write_status "Failed to create $HOME/.ssh/config." "Error" failed_count=$((failed_count + 1)) fi else write_status "Found ${#config_files[@]} SSH configuration file(s) to process." "Info" for config in "${config_files[@]}"; do if [[ ! -w "$config" ]]; then write_status "Cannot modify $config (permission denied)" "Warning" failed_count=$((failed_count + 1)) continue fi # Check for ProxyCommand with unquoted %r unquoted_found=false while IFS= read -r line; do [[ "$line" =~ ^[[:space:]]*# ]] && continue [[ -z "${line// }" ]] && continue if echo "$line" | grep -qi "ProxyCommand" && echo "$line" | grep -q "%r"; then if ! echo "$line" | grep -qE "'%r'"; then unquoted_found=true break fi fi done < "$config" if [[ "$unquoted_found" == true ]]; then write_status "Found unquoted %r in ProxyCommand within: $config" "Info" write_status "Applying mitigation: quoting %r tokens..." "Info" # Use sed to quote unquoted %r tokens # This regex finds %r not already in single quotes if sed -i.bak-cve-2025-61984 -E "s/([^'])%r([^'])/\1'%r'\2/g; s/^%r([^'])/'%r'\1/; s/([^'])%r$/\1'%r'/; s/^%r$/'%r'/" "$config" 2>/dev/null; then write_status "Successfully applied mitigation to: $config" "Success" mitigation_count=$((mitigation_count + 1)) else write_status "Failed to modify: $config" "Error" failed_count=$((failed_count + 1)) fi else write_status "No vulnerable ProxyCommand configurations found in: $config" "Safe" fi done fi fi # Git Configuration Mitigation echo "" echo "------- Git Configuration Mitigation -------" echo "" if command -v git &> /dev/null; then write_status "Git is installed. Configuring protocol restrictions..." "Info" # Collect Git config files to modify git_configs_to_modify=() if [[ $EUID -eq 0 ]]; then # Running as root - modify all users' Git configs while IFS=: read -r username _ uid _ _ homedir _; do # Skip system users (UID < 1000) except root if [[ $uid -ge 1000 || $uid -eq 0 ]] && [[ -d "$homedir" ]]; then git_config_file="$homedir/.gitconfig" git_configs_to_modify+=("$git_config_file:$username:$homedir") fi done < /etc/passwd else # Running as regular user - only modify current user's config git_configs_to_modify+=("$HOME/.gitconfig:$USER:$HOME") fi if [[ ${#git_configs_to_modify[@]} -eq 0 ]]; then write_status "No Git configuration files to modify." "Warning" failed_count=$((failed_count + 2)) else for config_entry in "${git_configs_to_modify[@]}"; do IFS=: read -r git_config_file config_user homedir <<< "$config_entry" # Ensure the config file exists and is writable if [[ ! -f "$git_config_file" ]]; then # Create .gitconfig if it doesn't exist if touch "$git_config_file" 2>/dev/null; then # Set proper ownership if running as root if [[ $EUID -eq 0 && "$config_user" != "root" ]]; then chown "$config_user:" "$git_config_file" 2>/dev/null fi chmod 644 "$git_config_file" 2>/dev/null else write_status "Cannot create Git config for user '$config_user' - skipping." "Warning" continue fi fi # Check current configuration current_protocol=$(git config --file "$git_config_file" protocol.allow 2>/dev/null) if [[ -z "$current_protocol" ]]; then if git config --file "$git_config_file" protocol.allow never 2>/dev/null; then write_status "User '$config_user': Successfully configured Git to deny automatic protocol connections." "Success" mitigation_count=$((mitigation_count + 1)) else write_status "User '$config_user': Failed to configure Git protocol settings." "Error" failed_count=$((failed_count + 1)) fi elif [[ "$current_protocol" == "never" ]]; then write_status "User '$config_user': Git protocol.allow already set to 'never' - no changes needed." "Safe" else if git config --file "$git_config_file" protocol.allow never 2>/dev/null; then write_status "User '$config_user': Successfully updated Git protocol configuration." "Success" mitigation_count=$((mitigation_count + 1)) else write_status "User '$config_user': Failed to update Git protocol settings." "Error" failed_count=$((failed_count + 1)) fi fi # Configure submodule recursion if git config --file "$git_config_file" submodule.recurse false 2>/dev/null; then write_status "User '$config_user': Successfully disabled automatic submodule recursion." "Success" mitigation_count=$((mitigation_count + 1)) else write_status "User '$config_user': Failed to configure Git submodule recursion." "Error" failed_count=$((failed_count + 1)) fi done fi else write_status "Git is not installed - no Git-related mitigations needed." "Info" fi # Final Summary echo "" echo "------------- Mitigation Summary -------------" echo "" write_status "Mitigations applied: $mitigation_count" "Info" if [[ $failed_count -gt 0 ]]; then write_status "Failed operations: $failed_count" "Warning" write_status "Some mitigations could not be applied. Review warnings above." "Warning" fi if [[ $mitigation_count -gt 0 ]]; then write_status "CVE-2025-61984 mitigation measures have been applied." "Success" else write_status "No mitigations were necessary or none could be applied." "Info" fi echo "" write_status "IMPORTANT: Mitigations are intended only as temporary measures and might not fully protect your system from CVE-2025-61984." "Warning" write_status "Whenever possible, upgrade OpenSSH to version 10.1 or later to ensure complete protection." "Warning"

PoC video

Description