CVE-2019-6111
MEDIUM EXPLOITED IN THE WILD RANSOMWAREOpenSSH < 7.9 - Arbitrary File Write via Malicious SCP Server
Title source: llmExploitation Summary
CVE-2019-6111 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io), including in ransomware campaigns. EIP tracks 4 public exploits from researchers including Mark E. Haase, Harry Sintonen, 53n7hu.
AI-analyzed exploit summary This exploit demonstrates CVE-2019-6111 and CVE-2019-6110 in OpenSSH's SCP client by sending an additional malicious file (exploit.txt) and hiding its transfer using ANSI escape sequences. It sets up a fake SCP server that exploits vulnerable clients during file downloads.
Description
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).
Exploits (4)
This exploit demonstrates CVE-2019-6111 and CVE-2019-6110 in OpenSSH's SCP client by sending an additional malicious file (exploit.txt) and hiding its transfer using ANSI escape sequences. It sets up a fake SCP server that exploits vulnerable clients during file downloads.
This exploit demonstrates CVE-2019-6110 and CVE-2019-6111 in OpenSSH's SCP client by creating a malicious SCP server that sends an additional file (exploit.txt) and hides the transfer using ANSI escape sequences. It leverages the SCP protocol's lack of proper validation to manipulate file transfers and terminal output.
This repository documents CVE-2019-6111, an SSH client vulnerability in Cisco SD-WAN v20.4.2.1 that allows file overwrite via malicious SSH servers, potentially leading to RCE. It references external PoCs and requires MITM or social engineering.
References (23)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N