CVE-2025-61985 Overview
CVE-2025-61985 affects OpenSSH versions before 10.1. The ssh client accepts the null character (\0) inside an ssh:// Uniform Resource Identifier (URI). When a ProxyCommand is configured, this embedded null byte can lead to code execution in the context of the invoking user. The flaw is tracked under CWE-158: Improper Neutralization of Null Byte or NUL Character. OpenSSH addressed the issue in the 10.1p1 release. Siemens has published a downstream advisory covering affected industrial products that bundle OpenSSH.
Critical Impact
An attacker who can influence an ssh:// URI processed by a client using ProxyCommand may achieve local code execution as the invoking user.
Affected Products
- OpenSSH ssh client versions prior to 10.1
- OpenSSH portable release before 10.1p1
- Siemens products bundling vulnerable OpenSSH builds (see Siemens Product Security Advisory)
Discovery Timeline
- 2025-10-06 - CVE-2025-61985 published to the National Vulnerability Database (NVD)
- 2026-07-14 - Last updated in NVD database
Technical Details for CVE-2025-61985
Vulnerability Analysis
OpenSSH's ssh client parses connection targets supplied as ssh://user@host/path URIs. Before version 10.1, the URI parser did not reject embedded null bytes in the userinfo, host, or path components. Downstream code that consumes the parsed fields treats the null byte as a string terminator, so the effective value differs from what URI validation logic accepted.
When the client resolves a ProxyCommand template such as %h (host) or %r (remote user), the truncated string is substituted into the command line. An attacker who controls the URI can craft input that passes validation as one value but expands into a different shell fragment inside the ProxyCommand invocation.
Exploitation requires a local context: the attacker must supply an ssh:// URI to a client configured with ProxyCommand. Typical attack surfaces include Git submodule URLs, package manifests, and scripts that pass user-controlled arguments to ssh.
Root Cause
The root cause is inconsistent handling of the null character between the URI parser and downstream shell composition [CWE-158]. The parser tolerates \0 inside URI components, while C string operations that build the ProxyCommand truncate at the null byte, producing a value that bypasses intended validation.
Attack Vector
The attack requires local access and a client configured to use ProxyCommand. An attacker crafts a malicious ssh:// URI containing an embedded null byte followed by attacker-controlled shell content. When the victim invokes ssh against that URI, the shell substitution in ProxyCommand yields commands under the attacker's control.
Refer to the OpenSSH Mailing List Discussion and Openwall OSS-Security Post for the disclosure thread and technical rationale.
Detection Methods for CVE-2025-61985
Indicators of Compromise
- Process telemetry showing ssh spawning shells or interpreters with arguments derived from URI fields containing suspicious characters
- Command-line arguments to ssh that include ssh:// URIs with non-printable or embedded control bytes
- Unexpected child processes of ssh invoked via ProxyCommand that do not match the configured proxy binary
Detection Strategies
- Inspect audit logs and shell histories for ssh ssh://... invocations originating from automation, Git operations, or package managers
- Monitor OpenSSH client versions across the fleet and flag hosts still running versions earlier than 10.1p1
- Alert on ProxyCommand expansions where %h or %r values contain null bytes or unexpected shell metacharacters
Monitoring Recommendations
- Capture execve telemetry for the ssh binary and its children, then correlate arguments against a null-byte pattern
- Review CI/CD pipelines and Git hosting integrations that clone repositories containing submodules with ssh:// URLs
- Track vendor advisories such as the Siemens Product Security Advisory for embedded OpenSSH updates
How to Mitigate CVE-2025-61985
Immediate Actions Required
- Upgrade OpenSSH client packages to 10.1p1 or later on all workstations, servers, and build hosts
- Audit SSH client configurations for ProxyCommand usage and enumerate systems that consume user-supplied ssh:// URIs
- Apply vendor-specific patches from downstream distributors, including the Siemens advisory for affected industrial products
Patch Information
The fix ships in the OpenSSH 10.1p1 release. See the OpenSSH Release Notes 10.1p1 for the changelog. Update through the operating system's package manager once vendor packages incorporate 10.1p1. Rebuild container images and virtual machine templates that bundle the ssh client to remove vulnerable versions from the supply chain.
Workarounds
- Avoid ProxyCommand configurations that expand untrusted URI components such as %h or %r without validation
- Reject ssh:// URIs from untrusted sources by pre-validating input for control characters before passing it to ssh
- Constrain the ssh client to a wrapper that sanitizes arguments and forbids embedded null bytes
# Configuration example: verify installed OpenSSH version and inspect ProxyCommand usage
ssh -V
grep -R "ProxyCommand" /etc/ssh/ssh_config /etc/ssh/ssh_config.d/ ~/.ssh/config 2>/dev/null
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
