7.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2020-15778

CVE-2020-15778: scp in OpenSSH through 8.3p1 allows command injection in scp.c remote function, as demonstrated...

scp in OpenSSH through 8.3p1 allows command injection in scp.c remote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2020-15778

CVE-2020-15778:

7.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability CVE-2020-15778 occurs because the client-side 'scp' command can be made to construct a command string for the remote server that includes unsanitized shell metacharacters in the destination filename. The 'toremote' function in 'scp.c' is responsible for creating this command string (e.g., 'scp -t malicious_filename'). When this string is passed to the remote 'sshd' and then executed by the remote user's shell, the shell interprets any metacharacters (like backticks) in 'malicious_filename', leading to command injection. The 'main' function is involved as it calls 'toremote'. The 'sink' function on the remote side is what's invoked by 'scp -t', but the injection happens due to shell processing of its arguments before 'sink' fully takes control. The discoverer's information and the nature of 'scp' relying on shell argument passing support this. The vendor's statement about not wanting to break workflows by validating 'anomalous argument transfers' further indicates this is a known behavior related to how scp arguments are handled by the shell.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.