iTerm2 Flaw Abuses SSH Integration Escape Sequences to Turn Text Into Code Execution
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
Cybersecurity researchers, working in partnership with OpenAI, have uncovered a fascinating and severe vulnerability in iTerm2, a widely used macOS terminal emulator.<\/p>\n
According to Califio, the flaw abuses the application\u2019s SSH integration feature, allowing attackers to turn seemingly harmless text output into local remote code execution (RCE).<\/a><\/p>\n Simply viewing a maliciously crafted text file can trigger the exploit. To grasp how this exploit works, it helps to understand iTerm2\u2019s SSH integration.<\/p>\n Rather than unthinkingly typing commands into a remote shell, iTerm2 deploys a tiny helper script, the \u201cconductor,\u201d to the remote machine.<\/p>\n This script communicates with iTerm2 to coordinate tasks like discovering the login shell, changing directories, and uploading files. Crucially, this protocol does not use a separate network service.<\/p>\n The Califio research team explains that the conductor script operates inside the remote shell session, and all communication is carried over normal terminal input\/output (I\/O) via the pseudoterminal (PTY)<\/a>.<\/p>\n The vulnerability stems from a fundamental trust failure. iTerm2 accepts the SSH conductor protocol from any terminal output<\/a>, even if it does not originate from a verified, trusted conductor session.<\/p>\n This means that untrusted terminal output can effectively impersonate the remote conductor by using specific terminal escape sequences:<\/p>\n If an attacker hides these sequences in a text file, server response, or Message of the Day (MOTD)<\/a>, rendering that text triggers the flaw.<\/p>\n\n