A vulnerability (CVE-2024-28085) has been identified in the wall utility provided in the util-linux package, which is designed for sending messages to terminals. This vulnerability allows an attack on other users' terminals through manipulation of escape sequences. The issue arises because the wall utility blocks the use of escape sequences in the input stream, but does not perform this operation for command-line arguments, allowing an attacker to execute escape sequences in another user's terminal.
For example, executing ‘wall $(printf ‘\033[33mHI’) can display the text ‘HI’ in yellow. By using escape sequences that allow moving the cursor, clearing, and replacing content on the screen, an attacker can simulate a password prompt from the sudo utility in another user's terminal. If the user does not notice the deception and enters their password, it will be exposed in the input history as a non-existent command (essentially the user enters their password in the command line instead of a command). ‘\033[3A’ // moves the cursor up 3 lines ‘\033[K’ // removes the previous output ‘[sudo] password for a_user:’ // displays a fake sudo prompt ‘\033[?25l’ // sets the background color to hide input ‘\033[38;2;48;10;36m’
During the output of a warning that the entered command is not found, many distributions invoke the /usr/lib/command-not-found handler, which attempts to identify the package containing the missing command and provide a hint for its installation. The problem is that when the command-not-found handler is executed, the non-existent command is passed to it as a command-line parameter, which is visible when viewing processes in the system (for example, when attempting to run the uninstalled utility ‘xsnow’, the process list will show ‘/usr/lib/command-not-found -- xsnow’). Accordingly, an attacker can organize monitoring of launched processes (for example, analyzing the appearance of ‘/proc/$pid/cmdline’ for a predicted PID number) and determine the password entered by the victim in the command line.
To have the user enter a password in response to a fake sudo prompt, a trick is proposed that involves monitoring the process list for the actual invocation of the sudo utility, waiting for its completion, and launching an attack via "wall" immediately thereafter. By manipulating escape sequences, the attacker can replace the message after the actual execution of sudo with a fake prompt for re-entering the password. The victim may think they made an error while entering and input the password a second time, exposing the password in the arguments of the "command-not-found" handler.
For a successful attack, the "mesg" mode needs to be set to "y", which is the default in Ubuntu, Debian, and CentOS/RHEL. The possibility of carrying out the attack has been demonstrated in Ubuntu 22.04 in the default configuration while using gnome-terminal. In Debian, the attack is more challenging since the default distribution does not include the "command-not-found" handler, and in CentOS/RHEL, the attack won't work because the wall utility is installed without the setgid flag and does not have access to other users' terminals. When using windows-terminal, the attack can be modified to change the clipboard content.
The vulnerability has existed in the util-linux package since 2013, after the ability to specify a message in the wall command line was added in release 2.24, but escape sequence sanitization was overlooked. A fix for the vulnerability was included in yesterday's release of util-linux 2.40. Notably, an attempt to fix the vulnerability in util-linux 2.39 revealed another similar vulnerability that allows the substitution of control characters through locale manipulation.
Source: opennet.ru
