Exploitation Summary
EIP tracks 1 public exploit for CVE-2020-26301. PoCs published by AikidoSec.
AI-analyzed exploit summary This repository contains a functional PoC for CVE-2020-26301, demonstrating command injection in the 'ssh2' library's agent function. The vulnerable test case shows how arbitrary commands can be executed via crafted input, while the protected test case shows mitigation using AikidoSec's firewall.
Description
ssh2 is client and server modules written in pure JavaScript for node.js. In ssh2 before version 1.4.0 there is a command injection vulnerability. The issue only exists on Windows. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This is fixed in version 1.4.0.
Exploits (1)
This repository contains a functional PoC for CVE-2020-26301, demonstrating command injection in the 'ssh2' library's agent function. The vulnerable test case shows how arbitrary commands can be executed via crafted input, while the protected test case shows mitigation using AikidoSec's firewall.
References (3)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N