Login Sign Up

CVE-2021-33477

8.8 HIGH
Remote Code Execution

📋 TL;DR

This vulnerability allows remote code execution in multiple terminal emulators (rxvt-unicode, rxvt, mrxvt, Eterm) through improper handling of ESC G Q escape sequences. Attackers can execute arbitrary code when users view malicious content in these terminals. Anyone using affected versions of these terminal emulators is potentially vulnerable.

💻 Affected Systems

Products:
  • rxvt-unicode
  • rxvt
  • mrxvt
  • Eterm
Versions: rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, Eterm 0.9.7 and earlier affected versions
Operating Systems: Linux, Unix-like systems
Default Config Vulnerable: ⚠️ Yes
Notes: Vulnerability exists in default configurations when processing escape sequences. All users of these terminal emulators are affected.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Eterm by Eterm Project

View all CVEs affecting Eterm →

Fedora by Fedoraproject

View all CVEs affecting Fedora →

Fedora by Fedoraproject

View all CVEs affecting Fedora →

Mrxvt by Mrxvt Project

View all CVEs affecting Mrxvt →

Rxvt by Rxvt Project

View all CVEs affecting Rxvt →

Rxvt Unicode by Rxvt Unicode Project

View all CVEs affecting Rxvt Unicode →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote attacker gains full control of the victim's system by executing arbitrary code with user privileges, potentially leading to complete system compromise.

🟠

Likely Case

Attackers execute malicious code when users view specially crafted content (like malicious log files or network output) in vulnerable terminals.

🟢

If Mitigated

No impact if patched versions are used or if vulnerable terminals are not exposed to untrusted input.

🌐 Internet-Facing: MEDIUM - Risk exists if terminals process untrusted network output, but requires user interaction or specific configurations.
🏢 Internal Only: MEDIUM - Internal users could be targeted via malicious files or network services, but requires user to use vulnerable terminal with affected content.

🎯 Exploit Status

Public PoC: ⚠️ Yes
Weaponized: LIKELY
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

Exploitation requires user to view malicious content in vulnerable terminal. Public references demonstrate the vulnerability and exploitation method.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check vendor updates - rxvt-unicode 9.23+, rxvt 2.7.11+, mrxvt 0.5.5+, Eterm 0.9.8+

Vendor Advisory: https://lists.debian.org/debian-lts-announce/2021/05/msg00026.html

Restart Required: No

Instructions:

1. Update terminal emulator using package manager (apt-get update && apt-get upgrade rxvt-unicode). 2. Verify installation of patched version. 3. Restart terminal sessions.

🔧 Temporary Workarounds

Disable vulnerable terminals

linux

Replace vulnerable terminal emulators with patched alternatives or different terminals

sudo apt-get remove rxvt-unicode rxvt mrxvt eterm
sudo apt-get install gnome-terminal xterm

Restrict terminal usage

all

Limit use of vulnerable terminals to trusted environments only

🧯 If You Can't Patch

  • Avoid viewing untrusted content in vulnerable terminals
  • Use alternative terminal emulators that are not affected

🔍 How to Verify

Check if Vulnerable:

Check terminal version: rxvt -version, urxvt -version, or check package manager: dpkg -l | grep -E '(rxvt|eterm)'

Check Version:

rxvt -version 2>&1 | head -1; urxvt -version 2>&1 | head -1

Verify Fix Applied:

Verify updated version is installed: dpkg -l | grep -E '(rxvt|eterm)' and check version numbers against patched versions

📡 Detection & Monitoring

Log Indicators:

  • Unusual terminal crashes
  • Suspicious escape sequence patterns in logs

Network Indicators:

  • Malformed escape sequences in network traffic to terminal services

SIEM Query:

source="terminal.log" AND "ESC G Q" OR "escape sequence" AND (process="rxvt" OR process="urxvt" OR process="eterm")

📊 Metadata

CVE ID: CVE-2021-33477
CVSS v3 Score: 8.8 (HIGH)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-755
Published: May 20, 2021
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-33477, you might also want to check these:

CVE-2022-48328 9.8

This vulnerability in MISP (Malware Information Sharing Platform) allows SQL injection through misha...

Same vulnerability type (CWE-755)
CVE-2021-43272 9.8

This vulnerability allows remote code execution through malicious DWF files in Open Design Alliance ...

Same vulnerability type (CWE-755)
CVE-2022-23121 9.8

CVE-2022-23121 is a critical remote code execution vulnerability in Netatalk's AppleDouble parsing f...

Same vulnerability type (CWE-755)