CVE-2024-34713

sshproxy is used on a gateway to transparently proxy a user SSH connection on the gateway to an internal host via SSH. Prior to version 1.6.3, any user authorized to connect to a ssh server using `sshproxy` can inject options to the `ssh` command executed by `sshproxy`. All versions of `sshproxy` are impacted. The problem is patched starting in version 1.6.3. The only workaround is to use the `force_command` option in `sshproxy.yaml`, but it's rarely relevant.

• CWE-77

• https://github.com/cea-hpc/sshproxy/commit/f7eabd05d5f0f951e160293692327cad9a7d9580
• https://github.com/cea-hpc/sshproxy/security/advisories/GHSA-jmqp-37m5-49wh
• https://github.com/cea-hpc/sshproxy/commit/f7eabd05d5f0f951e160293692327cad9a7d9580
• https://github.com/cea-hpc/sshproxy/security/advisories/GHSA-jmqp-37m5-49wh

Published

May 14, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-34708Directus is a real-time API and App dashboard for managing S…4.9
• CVE-2024-34709Directus is a real-time API and App dashboard for managing S…5.4
• CVE-2024-3471The Button Generator WordPress plugin before 3.0 does not h…3.4
• CVE-2024-34710Wiki.js is al wiki app built on Node.js. Client side templat…7.1
• CVE-2024-34711GeoServer is an open source server that allows users to shar…8.2
• CVE-2024-34712Oceanic is a NodeJS library for interfacing with Discord. Pr…6.5
• CVE-2024-34714The Hoppscotch Browser Extension is a browser extension for …7.6
• CVE-2024-34715Fides is an open-source privacy engineering platform. The Fi…3.3
• CVE-2024-34716PrestaShop is an open source e-commerce web application. A c…6.1
• CVE-2024-34717PrestaShop is an open source e-commerce web application. In …5.3
• CVE-2024-34719In multiple locations, there is a possible permissions bypas…7.8
• CVE-2024-3472The Modal Window WordPress plugin before 5.3.10 does not ha…5.9