Although separating the scp function from the ssh is a difficult task, it is inappropriate to run commands in the scp that transfers files. Will OpenSSH be able to restore the CVE? https://github.com/cpandya2909/CVE-2020-15778
this CVE stems from a misunderstanding of how scp works. It is an old program that *deliberately* invokes the remote shell for glob pattern expansion. We're not going to "fix" scp, but we might replace it entirely. There are significant backwards-compatibility concerns to work through however.
Maybe we can prevent this by configuring the mandatory command. A simple example is： ForceCommand if [[ -z $SSH_ORIGINAL_COMMAND ]];then exec /bin/bash -il;elif [[ -z "$(echo $SSH_ORIGINAL_COMMAND | grep scp | grep '`')" ]];then exec /bin/bash -c "$SSH_ORIGINAL_COMMAND";else echo backquote not allow in scp;fi
OpenSSH now uses sftp by default in the scp command
OpenSSH 9.3 has been released. Close resolved bugs