CVE-2021-32563
📋 TL;DR
Thunar file manager versions before 4.16.7 and 4.17.x before 4.17.2 automatically execute files without user confirmation when opened as command-line arguments. This allows attackers to trick users into executing malicious code by opening specially crafted files. Users of affected Thunar versions on Linux systems are vulnerable.
💻 Affected Systems
- Thunar File Manager
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via arbitrary code execution with user privileges, potentially leading to privilege escalation, data theft, or ransomware deployment.
Likely Case
Local privilege escalation or malware execution when users open malicious files from untrusted sources.
If Mitigated
Limited impact with proper user training and file source verification, though risk remains for automated processes.
🎯 Exploit Status
Exploitation requires user to open a malicious file via Thunar command line. Proof of concept details are publicly available in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Thunar 4.16.7 and 4.17.2
Vendor Advisory: https://gitlab.xfce.org/xfce/thunar/-/commit/1b85b96ebf7cb9bf6a3ddf1acee7643643fdf92d
Restart Required: No
Instructions:
1. Update Thunar using your distribution's package manager. 2. For Ubuntu/Debian: sudo apt update && sudo apt upgrade thunar. 3. For Fedora: sudo dnf update thunar. 4. Verify version after update.
🔧 Temporary Workarounds
Disable automatic file execution
linuxConfigure Thunar to require user confirmation before opening files via command line
gsettings set org.xfce.thunar.exec-always-ask true
Use alternative file manager
linuxTemporarily switch to a different file manager until Thunar is patched
sudo apt install nautilus
sudo dnf install nautilus
🧯 If You Can't Patch
- Implement strict user training about opening files from untrusted sources
- Use application whitelisting to prevent execution of unauthorized programs
🔍 How to Verify
Check if Vulnerable:
Check Thunar version: thunar --version. If version is below 4.16.7 or between 4.17.0-4.17.1, system is vulnerable.Check Version:
thunar --versionVerify Fix Applied:
After update, run: thunar --version. Should show 4.16.7 or higher, or 4.17.2 or higher.📡 Detection & Monitoring
Log Indicators:
- Unusual file execution patterns via Thunar
- Multiple failed execution attempts from command line
Network Indicators:
- Not applicable - local vulnerability
SIEM Query:
process.name:"thunar" AND process.cmd_line:*\.* AND event.action:"exec"🔗 References
- http://www.openwall.com/lists/oss-security/2021/05/11/3
- http://www.openwall.com/lists/oss-security/2023/01/05/1
- http://www.openwall.com/lists/oss-security/2023/01/05/2
- https://gitlab.xfce.org/xfce/thunar/-/commit/1b85b96ebf7cb9bf6a3ddf1acee7643643fdf92d
- https://gitlab.xfce.org/xfce/thunar/-/commit/3b54d9d7dbd7fd16235e2141c43a7f18718f5664
- https://gitlab.xfce.org/xfce/thunar/-/commit/9165a61f95e43cc0b5abf9b98eee2818a0191e0b
- https://gitlab.xfce.org/xfce/thunar/-/tags
- https://www.openwall.com/lists/oss-security/2021/05/09/2
- http://www.openwall.com/lists/oss-security/2021/05/11/3
- http://www.openwall.com/lists/oss-security/2023/01/05/1
- http://www.openwall.com/lists/oss-security/2023/01/05/2
- https://gitlab.xfce.org/xfce/thunar/-/commit/1b85b96ebf7cb9bf6a3ddf1acee7643643fdf92d
- https://gitlab.xfce.org/xfce/thunar/-/commit/3b54d9d7dbd7fd16235e2141c43a7f18718f5664
- https://gitlab.xfce.org/xfce/thunar/-/commit/9165a61f95e43cc0b5abf9b98eee2818a0191e0b
- https://gitlab.xfce.org/xfce/thunar/-/tags
- https://www.openwall.com/lists/oss-security/2021/05/09/2
