CVE-2023-46300
📋 TL;DR
CVE-2023-46300 is a critical remote code execution vulnerability in iTerm2's tmux integration feature. Attackers can exploit this by sending specially crafted escape sequences to execute arbitrary commands on the victim's system. All iTerm2 users with tmux integration enabled are affected.
💻 Affected Systems
- iTerm2
📦 What is this software?
Iterm2 by Iterm2
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining complete control over the victim's machine, allowing data theft, persistence installation, and lateral movement.
Likely Case
Remote code execution leading to malware installation, credential theft, and unauthorized access to sensitive data.
If Mitigated
Limited impact if tmux integration is disabled or proper network segmentation prevents malicious input.
🎯 Exploit Status
Public proof-of-concept code exists and exploitation requires minimal technical skill. Attack can be triggered through various input vectors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.4.20 and later
Vendor Advisory: https://iterm2.com/news.html
Restart Required: Yes
Instructions:
1. Open iTerm2. 2. Go to iTerm2 → Check for Updates. 3. Install version 3.4.20 or later. 4. Restart iTerm2.
🔧 Temporary Workarounds
Disable tmux integration
allTemporarily disable tmux integration feature to prevent exploitation
Go to iTerm2 → Preferences → Profiles → tmux → Uncheck 'Automatically start tmux sessions'
🧯 If You Can't Patch
- Disable tmux integration completely in iTerm2 preferences
- Use alternative terminal emulators until patch can be applied
🔍 How to Verify
Check if Vulnerable:
Check iTerm2 version in iTerm2 → About iTerm2. If version is below 3.4.20, you are vulnerable.Check Version:
iTerm2 → About iTerm2 or check via command line: defaults read com.googlecode.iterm2 'CFBundleShortVersionString'Verify Fix Applied:
Verify iTerm2 version is 3.4.20 or higher in iTerm2 → About iTerm2.📡 Detection & Monitoring
Log Indicators:
- Unusual process execution from iTerm2
- Suspicious escape sequences in terminal logs
- Unexpected tmux session creation
Network Indicators:
- Malicious escape sequences in network traffic to terminal sessions
- Unexpected outbound connections from iTerm2 processes
SIEM Query:
process_name:iTerm2 AND (process_command_line:*tmux* OR process_command_line:*escape* OR process_command_line:*\x1b*)🔗 References
- https://blog.solidsnail.com/posts/2023-08-28-iterm2-rce
- https://github.com/gnachman/iTerm2/commit/ae8192522661c34d1cbe57f6f9ef2ff0a337c2a5
- https://github.com/gnachman/iTerm2/commit/b2268b03b5f3d4cd8ca275eaef5d16d0fac20009
- https://iterm2.com/news.html
- https://blog.solidsnail.com/posts/2023-08-28-iterm2-rce
- https://github.com/gnachman/iTerm2/commit/ae8192522661c34d1cbe57f6f9ef2ff0a337c2a5
- https://github.com/gnachman/iTerm2/commit/b2268b03b5f3d4cd8ca275eaef5d16d0fac20009
- https://iterm2.com/news.html
