| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/gravitational/teleport | ≥ 10.0.0, < 10.1.2≥ 9.0.0, < 9.3.13< 8.3.17 | 10.1.29.3.138.3.17 |
| teleport | < 10.1.2 | 10.1.2 |
Teleport 9.3.6 is vulnerable to Command injection leading to Remote Code Execution. An attacker can craft a malicious ssh agent installation link by URL encoding a bash escape with carriage return line feed. This url encoded payload can be used in place of a token and sent to a user in a social engineering attack. This is fully unauthenticated attack utilizing the trusted teleport server to deliver the payload.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free