CVE-2025-61984: OpenSSH RCE Vulnerability

CVE-2025-61984 Overview

CVE-2025-61984 is a command injection vulnerability in OpenSSH versions prior to 10.1 that allows control characters in usernames originating from untrusted sources. When a ProxyCommand is configured, these malicious control characters can potentially lead to code execution. The untrusted sources include command-line input and %-sequence expansion of configuration files. Notably, configuration files that provide complete literal usernames are not categorized as untrusted sources.

Critical Impact

Attackers with local access can inject control characters into SSH usernames, potentially achieving arbitrary code execution when ProxyCommand is enabled in the SSH configuration.

Affected Products

• OpenSSH versions before 10.1
• Systems using ProxyCommand configurations with user-controlled input
• SSH clients processing usernames from command-line or %-sequence expansion

Discovery Timeline

• 2025-10-06 - CVE-2025-61984 published to NVD
• 2025-11-11 - Last updated in NVD database

Technical Details for CVE-2025-61984

Vulnerability Analysis

This vulnerability exploits insufficient input validation in OpenSSH's handling of usernames when they are passed to ProxyCommand configurations. The core issue lies in how OpenSSH processes usernames that may contain control characters, particularly newlines and other special characters that can alter command execution flow.

When a user specifies a username via the command line or through %-sequence expansion in a configuration file, OpenSSH fails to properly sanitize these inputs before passing them to the shell for ProxyCommand execution. This allows an attacker to inject arbitrary shell commands by embedding control characters within the username field.

The vulnerability is classified under CWE-159 (Improper Handling of Invalid Use of Special Elements), highlighting the failure to properly handle special characters that have meaning in the execution context.

Root Cause

The root cause stems from OpenSSH's insufficient sanitization of username input before it is interpolated into ProxyCommand shell execution. When usernames are sourced from the command line or configuration file %-sequences, control characters such as newlines (\n) are not stripped or escaped. This allows attackers to break out of the intended command context and inject additional shell commands.

The vulnerability specifically affects the interaction between bash's handling of newlines and SSH's ProxyCommand feature, where a carefully crafted username containing a newline can result in command injection.

Attack Vector

The attack requires local access to the system and leverages the ProxyCommand feature commonly used for SSH proxying and tunneling. An attacker can craft a malicious username containing control characters (particularly newlines) that, when expanded in the ProxyCommand context, results in arbitrary command execution.

The exploitation scenario typically involves:

1. An attacker with local access to a system running a vulnerable OpenSSH version
2. An SSH configuration that utilizes ProxyCommand with username expansion
3. A crafted username containing control characters injected via command-line or %-sequence expansion

The attack exploits how bash interprets newline characters within command substitution, allowing an attacker to inject additional commands that execute in the context of the SSH client process.

Detection Methods for CVE-2025-61984

Indicators of Compromise

• Unusual SSH connection attempts with usernames containing non-printable or control characters
• Unexpected command execution patterns originating from SSH client processes
• SSH client logs showing malformed or unusually long usernames
• Shell history entries containing suspicious ssh commands with encoded characters

Detection Strategies

• Monitor SSH client command-line arguments for control characters or encoded newlines in username fields
• Implement logging of ProxyCommand execution to detect anomalous command patterns
• Review SSH configuration files for %-sequence expansions that may be vulnerable to injection
• Deploy endpoint detection rules to identify SSH processes spawning unexpected child processes

Monitoring Recommendations

• Enable verbose logging on SSH clients to capture connection parameters
• Configure system auditing to monitor SSH binary execution and associated arguments
• Implement file integrity monitoring on SSH configuration files
• Review authentication logs for usernames with non-ASCII characters or unusual patterns

How to Mitigate CVE-2025-61984

Immediate Actions Required

• Upgrade OpenSSH to version 10.1 or later immediately
• Audit SSH configurations for ProxyCommand usage with user-controlled input
• Review and restrict access to systems running vulnerable OpenSSH versions
• Temporarily disable ProxyCommand configurations that accept untrusted username input

Patch Information

The vulnerability is addressed in OpenSSH version 10.1p1. The fix implements proper sanitization of control characters in usernames before they are passed to ProxyCommand execution. Administrators should upgrade to this version or later to remediate the vulnerability.

For detailed release information, see the OpenSSH Release Notes 10.1p1. Additional technical discussion is available on the OpenSSH Developer Mailing List.

Community-provided detection and mitigation scripts are available from Vicarius Detection Script and Vicarius Mitigation Script.

Workarounds

• Avoid using ProxyCommand configurations that accept usernames from untrusted sources
• Use complete literal usernames in SSH configuration files rather than relying on %-sequence expansion
• Implement input validation at the application layer before passing usernames to SSH
• Restrict SSH client execution to trusted users and processes until patching is complete

# Verify OpenSSH version
ssh -V

# Check for ProxyCommand usage in SSH configs
grep -r "ProxyCommand" ~/.ssh/config /etc/ssh/ssh_config 2>/dev/null

# Update OpenSSH on Debian/Ubuntu
sudo apt update && sudo apt install openssh-client

# Update OpenSSH on RHEL/CentOS
sudo dnf update openssh-clients