PT-2023-14924 · Conemu+1 · Conemu+1

David Leadbeater · Published 2023-03-28 · Updated 2024-03-16 · CVE-2022-46387

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ConEmu versions prior to 220807 Cmder versions prior to 1.3.21

Description The issue allows an attacker to change the title of the terminal, including control characters, which can then be executed as commands. This is related to the handling of ASCII escape sequences, which can alter terminal states, including executing commands in affected terminals.

Recommendations For ConEmu versions prior to 220807, update to version 220807 or later to resolve the issue. For Cmder versions prior to 1.3.21, update to version 1.3.21 or later to resolve the issue. As a temporary workaround, consider restricting the use of control characters in terminal titles to minimize the risk of exploitation.

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

CVE-2022-46387

Affected Products

Cmder

Conemu

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-46387 · Security Note
• https://osv.dev/vulnerability/CVE-2022-46387 · Vendor Advisory
• https://github.com/cmderdev/cmder/blob/master/CHANGELOG.md · Note
• https://gist.github.com/dgl/05ca60cdc7efc9e47bbc58d0c952635e · Note
• https://t.me/cibsecurity/70279 · Telegram Post
• https://twitter.com/adamsimuntis/status/1769124870774755349 · Twitter Post