Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability exists in how the ScpClient class handles remote file paths for SCP operations. The root cause is that several public constructors of ScpClient did not require the user to specify a path transformation strategy. Instead, they used a default transformation (RemotePathTransformation.DoubleQuote) that only escapes double quotes. This is insufficient for many common shell environments (like bash) where command substitution can be achieved using other characters, such as $(...) or backticks (`...`), even within a double-quoted string.
An attacker could provide a specially crafted remote file path to an application using the vulnerable ScpClient. When the application performs an Upload or Download operation, this malicious path is embedded into the scp command executed on the remote server. Due to the inadequate default escaping, the crafted path can be interpreted as a command by the server's shell, leading to remote code execution as the authenticated SSH user.
The patch addresses this by obsoleting the constructors that used the unsafe default. It introduces new constructors that require the developer to explicitly provide an IRemotePathTransformation implementation, forcing them to make a conscious decision about how to handle path escaping based on their knowledge of the remote server's environment. For POSIX shells, the library now provides RemotePathTransformation.ShellQuote as a more secure option.
Renci.SshNet.ScpClient.ScpClient(ConnectionInfo connectionInfo)src/Renci.SshNet/ScpClient.cs
Renci.SshNet.ScpClient.ScpClient(string host, int port, string username, string password)src/Renci.SshNet/ScpClient.cs
Renci.SshNet.ScpClient.ScpClient(string host, string username, string password)src/Renci.SshNet/ScpClient.cs
Renci.SshNet.ScpClient.ScpClient(string host, int port, string username, params IPrivateKeySource[] keyFiles)src/Renci.SshNet/ScpClient.cs
Renci.SshNet.ScpClient.ScpClient(string host, string username, params IPrivateKeySource[] keyFiles)src/Renci.SshNet/ScpClient.cs
Renci.SshNet.ScpClient.Uploadsrc/Renci.SshNet/ScpClient.cs
Renci.SshNet.ScpClient.Downloadsrc/Renci.SshNet/ScpClient.cs
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| SSH.NET | nuget | < 2026.0.0 | 2026.0.0 |