PT-2024-27980 · Iterm2 · Iterm2

David Leadbeater + 1 · Published 2024-06-16 · Updated 2024-07-14 · CVE-2024-38396

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions iTerm2 versions 3.5.x through 3.5.1

Description An issue was discovered in iTerm2 that allows an attacker to inject arbitrary code into the terminal by abusing title reporting and tmux integration. This is possible due to the unfiltered use of an escape sequence to report a window title, in combination with the built-in tmux integration feature, which is enabled by default.

Recommendations For iTerm2 versions 3.5.x through 3.5.1, update to version 3.5.2 or later to resolve the issue. As a temporary workaround, consider disabling the tmux integration feature until a patch is available. Restrict access to the terminal to minimize the risk of exploitation. Avoid using the title reporting feature in the affected versions until the issue is resolved.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-38396

Affected Products

Iterm2

References · 12

• 🔥 https://github.com/vin01/poc-cve-2024-38396 · Exploit
• 🔥 https://vin01.github.io/piptagole/escape-sequences/iterm2/rce/2024/06/16/iterm2-rce-window-title-tmux-integration.html · Exploit
• https://osv.dev/vulnerability/CVE-2024-38396 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-38396 · Security Note
• https://gitlab.com/gnachman/iterm2/-/commit/fc60236a914d63fb70a5c632e211203a4f1bd4dd · Patch
• https://t.me/cybersecuritytechnologies/10697 · Telegram Post
• http://openwall.com/lists/oss-security/2024/06/17/1 · Note
• https://t.me/rnetsec/20481 · Telegram Post
• https://iterm2.com/downloads.html · Note
• https://t.me/defcon_news/124032 · Telegram Post
• https://t.me/securixy_kz/915 · Telegram Post
• https://t.me/cvenotify/83436 · Telegram Post