A vulnerability (CVE-2022-45063) has been identified in the xterm terminal emulator that allows execution of shell commands when processing certain escape sequences in the terminal. In a basic attack scenario, it is sufficient to display the contents of a specially crafted file, for instance using the cat utility, or to paste a line from the clipboard. printf "\e]50;i\$(touch /tmp/hack-like-its-1999)\a\e]50;?\a" > cve-2022-45063 cat cve-2022-45063
The issue is caused by an error in processing the escape sequence with code 50, used for setting or retrieving font parameters. If the requested font does not exist, the operation returns the font name specified in the request. Control characters cannot be directly inserted into the name, but the returned string can be terminated with the sequence "^G", which in zsh, when line editing mode in vi style is active, triggers the list expansion operation, which can be exploited to run commands without explicitly pressing the Enter key.
To successfully exploit the vulnerability, the user must use the Zsh shell with the command line editor switched to "vi" (vi-cmd-mode), which is typically not used by default in distributions. The issue also does not manifest when xterm settings allowWindowOps=false or allowFontOps=false are set. For example, the allowFontOps=false setting is applied in OpenBSD, Debian, and RHEL, but is not used by default in Arch Linux.
According to the changelog and the statement from the researcher who identified the issue, the vulnerability has been fixed in xterm release 375, but other sources indicate that the vulnerability continues to be present in xterm 375 from Arch Linux. You can track the distribution of patches on the following pages: Debian, RHEL, Fedora, SUSE, Ubuntu, Arch Linux, OpenBSD, FreeBSD, NetBSD.
Source: opennet.ru
