CVE-2021-3725
📋 TL;DR
CVE-2021-3725 is a command injection vulnerability in the dirhistory plugin for Oh My Zsh. It allows attackers to execute arbitrary commands by tricking users into navigating to directories with malicious names and using Alt-Left/Right keyboard shortcuts. This affects users of Oh My Zsh with the dirhistory plugin enabled.
💻 Affected Systems
- Oh My Zsh
📦 What is this software?
Oh My Zsh by Planetargon
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with arbitrary command execution as the current user, potentially leading to privilege escalation, data theft, or complete system takeover.
Likely Case
Local privilege escalation or arbitrary code execution within the user's context, allowing attackers to access sensitive files, install malware, or pivot to other systems.
If Mitigated
Limited impact if users don't use the dirhistory plugin or have restricted directory permissions, though the vulnerability still exists in the code.
🎯 Exploit Status
Exploitation requires: 1) User with dirhistory plugin enabled, 2) Ability to create directories with malicious names, 3) User pressing Alt-Left/Right after navigating to malicious directory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit 06fc5fb and later
Vendor Advisory: https://github.com/ohmyzsh/ohmyzsh/commit/06fc5fb
Restart Required: No
Instructions:
1. Update Oh My Zsh: 'omz update' 2. Or manually apply commit 06fc5fb 3. Restart terminal session
🔧 Temporary Workarounds
Disable dirhistory plugin
allRemove dirhistory from your Oh My Zsh plugins list
Edit ~/.zshrc and remove 'dirhistory' from plugins array
Avoid untrusted directories
allDo not navigate to directories with suspicious names
🧯 If You Can't Patch
- Disable the dirhistory plugin immediately
- Implement strict directory permissions to prevent users from creating directories with special characters
🔍 How to Verify
Check if Vulnerable:
Check if dirhistory plugin is enabled in ~/.zshrc and Oh My Zsh version is pre-commit 06fc5fbCheck Version:
cd ~/.oh-my-zsh && git log --oneline -1 | grep 06fc5fbVerify Fix Applied:
Verify Oh My Zsh is updated to commit 06fc5fb or later: 'cd ~/.oh-my-zsh && git log --oneline -1'📡 Detection & Monitoring
Log Indicators:
- Unusual command execution from zsh sessions
- Directory navigation patterns with special characters
Network Indicators:
- Outbound connections from zsh processes following directory navigation
SIEM Query:
process.name:zsh AND command_line:*eval* AND command_line:*directory*