TI-2024-23010 Aliases CVE-2024-34713 GHSA-jmqp-37m5-49wh

sshproxy vulnerable to SSH option injection

LOW 17CWE-77Published 2024-05-14 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-77.

Summary

sshproxy is used on a gateway to transparently proxy a user SSH connection on the gateway to an internal host via SSH. Prior to version 1.6.3, any user authorized to connect to a ssh server using `sshproxy` can inject options to the `ssh` command executed by `sshproxy`. All versions of `sshproxy` are impacted. The problem is patched starting in version 1.6.3. The only workaround is to use the `force_command` option in `sshproxy.yaml`, but it's rarely relevant.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00416 36th percentileScored 2026-11-07

Fix Fixed sshproxy (cea-hpc): 1.6.3github.com/cea-hpc/sshproxy (Go): 1.6.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
cea-hpc	sshproxy	before 1.6.3	1.6.3	Patch available	CNA
—	github.com/cea-hpc/sshproxy (Go)	before 1.6.3	1.6.3	Patch available	GHSA-jmqp-37m5-49wh

sshproxy Vendorcea-hpc Affected before 1.6.3 Fixed in 1.6.3 Patch available CNA
github.com/cea-hpc/sshproxy (Go) Vendor— Affected before 1.6.3 Fixed in 1.6.3 Patch available GHSA-jmqp-37m5-49wh

CPE names CISA-ADP · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:cea-hpc:sshproxy::::::::	—	—	—

cpe:2.3:a:cea-hpc:sshproxy:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Fix · CNA sshproxy (cea-hpc) Fixed in 1.6.3
Fix · GHSA-jmqp-37m5-49wh github.com/cea-hpc/sshproxy (Go) Fixed in 1.6.3 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-34713
2026-10-03 Alias added: GHSA-jmqp-37m5-49wh

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2024-34713

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences