PT-2023-14924 · Conemu+1 · Conemu+1

David Leadbeater · Publicado 2023-03-28 · Atualizado 2024-03-16 · CVE-2022-46387

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ConEmu versions prior to 220807 Cmder versions prior to 1.3.21

Description The issue allows an attacker to change the title of the terminal, including control characters, which can then be executed as commands. This is related to the handling of ASCII escape sequences, which can alter terminal states, including executing commands in affected terminals.

Recommendations For ConEmu versions prior to 220807, update to version 220807 or later to resolve the issue. For Cmder versions prior to 1.3.21, update to version 1.3.21 or later to resolve the issue. As a temporary workaround, consider restricting the use of control characters in terminal titles to minimize the risk of exploitation.

Correção

Improper Encoding or Escaping of Output

Enumeração de Fraquezas

CWE-116

Identificadores relacionados

CVE-2022-46387

Produtos afetados

Cmder

Conemu

Referências · 6

• https://github.com/cmderdev/cmder/blob/master/CHANGELOG.md · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2022-46387 · Nota de Segurança
• https://gist.github.com/dgl/05ca60cdc7efc9e47bbc58d0c952635e · Nota
• https://t.me/cibsecurity/70279 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2022-46387 · Aviso do Fabricante
• https://twitter.com/adamsimuntis/status/1769124870774755349 · Publicação no Twitter