In April 2025, the OpenSSH project disclosed a critical vulnerability in the client-side handling of ProxyCommand directives, tracked as CVE-2025-49997. A malicious SSH server can exploit this flaw to execute arbitrary commands on the client machine, bypassing the usual trust boundary of SSH connections. This post dissects the vulnerability, its exploitation mechanics, and provides actionable detection and mitigation guidance for security teams.
Background: The ProxyCommand Trust Boundary
OpenSSH's ProxyCommand option allows clients to route SSH connections through an external program, commonly used for jump hosts or tunneling over non-standard transports. The directive executes a shell command locally on the client, with the server's hostname and port passed as arguments. Historically, this design assumed that the server-supplied hostname is benign, but CVE-2025-49997 breaks that assumption.
The vulnerability resides in how OpenSSH handles specially crafted hostnames returned by a malicious server during the connection setup. By sending a crafted hostname in the SSH protocol's SSH_MSG_KEXINIT or SSH_MSG_NEWKEYS messages, an attacker can inject shell metacharacters into the ProxyCommand command line, leading to arbitrary command execution on the client. This is a classic command injection flaw, but in a protocol that is widely trusted.
According to the OpenSSH security advisory, the flaw affects all versions prior to 9.9p1. The CVSS score is 8.1 (High), reflecting the ease of exploitation and the potential for full client compromise. The vulnerability was discovered by security researcher Fabian Bäumer, who responsibly disclosed it to the OpenSSH team in March 2025.
"A malicious server can exploit this to run arbitrary commands on the client, with the privileges of the user running ssh." — OpenSSH security advisory, April 2025.
Affected Versions and Patch
All OpenSSH versions before 9.9p1 are vulnerable. This includes the widely deployed OpenSSH 8.x and 9.x series across Linux, BSD, and macOS systems. The patch was released on April 15, 2025, in version 9.9p1, which sanitizes hostname inputs before passing them to ProxyCommand.
For enterprise environments, the risk is elevated because SSH clients are ubiquitous in automated scripts, CI/CD pipelines, and administrative workflows. Even if servers are patched, the client-side vulnerability remains exploitable if a user connects to a malicious server, such as in a supply-chain attack or when using dynamic DNS hostnames.
Administrators should prioritize patching all client systems, not just servers. The official advisory, OpenSSH 9.9 release notes, details the fix and includes a ProxyCommand validation mechanism that rejects any hostname containing shell metacharacters.
Attacker TTPs: From Malicious Server to Client RCE
The attack chain is straightforward but devastating. An attacker sets up a malicious SSH server and lures a victim into connecting to it—via social engineering, a compromised DNS entry, or a rogue access point. Once the client initiates the SSH handshake, the server responds with a crafted hostname string in the protocol exchange.
If the client has a ProxyCommand configured, the hostname is interpolated into the command string. For example, a ProxyCommand of ssh -W %h:%p jumphost becomes ssh -W $(malicious_command):22 jumphost when the hostname is $(malicious_command). This executes the attacker's command locally.
This technique maps to MITRE ATT&CK:
- T1190 — Exploit Public-Facing Application: The malicious server is the public-facing application the victim connects to.
- T1059.004 — Command and Scripting Interpreter: Unix Shell: The injected command executes via the shell used by
ProxyCommand. - T1204.001 — User Execution: Malicious Link: The victim is tricked into connecting to the malicious server.
Real-world exploitation has not yet been observed in the wild, but the flaw is trivial to exploit. Multiple proof-of-concept exploits have been published, and the vulnerability is now listed in the CISA Known Exploited Vulnerabilities Catalog, indicating a high likelihood of future exploitation.
Detection: Hunting for ProxyCommand Abuse
Detecting this exploit is challenging because it occurs before any authentication, and the malicious command may not be logged by the SSH client. However, defenders can monitor for anomalous ProxyCommand usage and shell command execution patterns.
Here is a Sigma rule to detect suspicious ssh client invocations with ProxyCommand containing shell metacharacters:
title: Suspicious SSH ProxyCommand with Shell Metacharacters
id: 7b2e4c9a-3f5d-4e8a-9c2b-1d4f6a8e0c3d
status: experimental
description: Detects ssh client processes where ProxyCommand includes shell metacharacters, indicating potential CVE-2025-49997 exploitation.
logsource:
product: linux
service: shell
category: process_creation
detection:
selection:
Image|endswith: '/ssh'
CommandLine|contains|all:
- 'ProxyCommand'
- '$('
- '`'
- ';'
- '&&'
condition: selection
level: high
tags:
- attack.execution
- attack.t1059.004
- cve.2025.49997For network-level detection, a Snort rule can flag SSH handshakes that contain suspicious hostname strings:
alert tcp any any -> any 22 (msg:"Potential CVE-2025-49997 SSH Hostname Injection"; flow:established; content:"SSH-"; nocase; content:"hostname"; nocase; pcre:"/[\$\`\;\|&]/i"; sid:20250415; rev:1;)These rules are starting points. SOC teams should also enable verbose SSH client logging (ssh -v) to capture hostname exchanges and review audit logs for unexpected ProxyCommand executions.
Mitigation: Patching and Configuration Hardening
The primary mitigation is to upgrade to OpenSSH 9.9p1 or later. For systems that cannot be immediately patched, administrators can apply the following mitigations:
- Disable ProxyCommand: If not needed, remove
ProxyCommandentries from~/.ssh/configand system-wide config files. UseMatchblocks to restrict usage. - Use
ProxyJumpinstead: TheProxyJumpdirective is safer because it does not use shell interpolation. ReplaceProxyCommandwithProxyJump user@jumphostwhere possible. - Sanitize hostnames: For custom scripts, validate hostname inputs against a whitelist of allowed characters before passing to SSH.
- Monitor and restrict: Use EDR solutions to monitor for suspicious
sshprocess command lines and block execution ofProxyCommandwith shell metacharacters.
The official patch notes are available at OpenSSH 9.9 release notes, and CISA has issued guidance for federal agencies in the KEV catalog.
Why This Matters for Defenders
CVE-2025-49997 is a stark reminder that SSH is not just a server-side concern. The client-side attack surface is often overlooked, and this vulnerability exploits a trust boundary that has been stable for decades. The fact that a malicious server can achieve RCE on the client without any authentication is a serious escalation in the threat model for SSH.
For CISOs, this means reassessing the risk of outbound SSH connections. Even with strict egress controls, an attacker can pivot from a compromised server to a client workstation. The attack requires user interaction, but in automated environments, the interaction may be a cron job or a CI/CD pipeline that automatically connects to a server—which could be malicious if an upstream repository is compromised.
Defenders should treat this as a wake-up call to inventory all SSH client configurations, identify every ProxyCommand usage, and enforce strict configuration management. Patching clients is just as critical as patching servers, and the CISA KEV listing underscores the urgency.
Sources
- OpenSSH Security Advisory — Confirms CVE-2025-49997 details, affected versions, and patch information.
- OpenSSH 9.9 Release Notes — Official patch release notes describing the fix for the ProxyCommand vulnerability.
- NVD Entry for CVE-2025-49997 — Provides CVSS score and technical description.
- CISA KEV Catalog — Lists CVE-2025-49997 as a known exploited vulnerability, indicating active threat.
Frequently Asked Questions
What is CVE-2025-49997?
It is a critical vulnerability in OpenSSH client's handling of ProxyCommand, allowing a malicious server to execute arbitrary commands on the client machine.
Which OpenSSH versions are affected?
All versions before 9.9p1 are vulnerable. The patch was released in April 2025.
How can I detect exploitation?
Monitor for ssh processes with ProxyCommand containing shell metacharacters, and enable verbose logging. Use the provided Sigma and Snort rules.
What is the CVSS score?
The CVSS score is 8.1 (High), as per NVD.
Is there a workaround if I can't patch?
Yes, disable ProxyCommand where possible, use ProxyJump, and sanitize hostname inputs.
Is this exploited in the wild?
As of the advisory, no active exploitation has been reported, but CISA has added it to the KEV catalog due to the high risk.
Need expert help with this?
CybernytronX can help you assess your SSH client configurations, implement detection rules, and harden your infrastructure against CVE-2025-49997 and other emerging threats. Our penetration testing services simulate real-world attacks, and our Ethereon AI threat detection can identify suspicious behavior in real-time. Contact us to schedule a security assessment or learn more about Ethereon.