Xterm terminal emulator has a vulnerability (CVE-2022-45063), which allows for the execution of shell commands when processing certain escape sequences in the terminal. In the simplest case, it is enough to display the contents of a specially crafted file on the screen, for example, using the cat utility, or to paste a line from the clipboard. printf "\e]50;i\$(touch /tmp/hack-like-its-1999)\a\e]50;?\a" > cve-2022-45063 cat cve-2022-45063
The issue is caused by an error in processing the escape sequence with code 50, used for setting or getting font parameters. If the requested font does not exist, the operation returns the name of the font specified in the request. Control characters cannot be directly inserted into the name, but the returned string can be completed with a sequence "^G", which in zsh, when line editing mode in vi style is active, leads to the execution of the list expansion operation, which can be used to execute commands without explicitly pressing the Enter key.
To successfully exploit the vulnerability, the user must use the Zsh shell with the command line editor switched to "vi" mode (vi-cmd-mode), which is usually not enabled by default in distributions. The problem also does not manifest when the xterm settings allowWindowOps=false or allowFontOps=false are set. For example, the allowFontOps=false setting is applied in OpenBSD, Debian, and RHEL, but is not applied by default in Arch Linux.
According to the changelog and the statement from the researcher who discovered the issue, the vulnerability was fixed in release xterm 375, but other reports indicate that the vulnerability continues to manifest in xterm 375 from Arch Linux. You can track the release of fixes by distributions on these pages: Debian, RHEL, Fedora, SUSE, Ubuntu, Arch Linux, OpenBSD, FreeBSD, NetBSD.
Allikas: opennet.ru
