CVE-2024-23749
📋 TL;DR
CVE-2024-23749 is a command injection vulnerability in KiTTY that allows attackers to execute arbitrary code by manipulating filename inputs. This affects KiTTY versions 0.76.1.13 and earlier. Users who process untrusted files or inputs with vulnerable KiTTY versions are at risk.
💻 Affected Systems
- KiTTY
📦 What is this software?
Kitty by 9bis
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining complete control over the affected system, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Local privilege escalation or execution of malicious commands in the context of the KiTTY user, potentially leading to credential theft, data exfiltration, or persistence mechanisms.
If Mitigated
Limited impact with proper input validation and execution restrictions in place, potentially resulting in failed exploitation attempts or contained damage.
🎯 Exploit Status
Exploitation requires the attacker to control filename inputs, which could occur through malicious file uploads, crafted downloads, or user interaction with untrusted content.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.76.1.14 or later
Vendor Advisory: https://www.9bis.net/kitty/
Restart Required: Yes
Instructions:
1. Download latest KiTTY version from official website. 2. Uninstall vulnerable version. 3. Install patched version. 4. Restart system if KiTTY was running.
🔧 Temporary Workarounds
Input Validation Enhancement
allImplement strict filename validation to reject special characters and command injection attempts
Not applicable - requires code modification
Execution Restriction
allRun KiTTY with minimal privileges and in restricted environments
On Linux: chmod 755 kitty && setfacl -m u:kittyuser:rx kitty
On Windows: Configure AppLocker or similar restrictions
🧯 If You Can't Patch
- Disable or restrict KiTTY usage in environments processing untrusted files
- Implement network segmentation to isolate KiTTY instances from critical systems
🔍 How to Verify
Check if Vulnerable:
Check KiTTY version in Help > About menu or run 'kitty --version' in terminalCheck Version:
kitty --versionVerify Fix Applied:
Confirm version is 0.76.1.14 or later and test with known malicious filename patterns📡 Detection & Monitoring
Log Indicators:
- Unusual process spawns from KiTTY
- Suspicious command execution patterns
- Filename parameters containing shell metacharacters
Network Indicators:
- Unexpected outbound connections from KiTTY processes
- Command and control traffic patterns
SIEM Query:
process_name:"kitty.exe" AND (command_line:"*;*" OR command_line:"*&*" OR command_line:"*|*" OR command_line:"*`*" OR command_line:"*$(*")🔗 References
- http://packetstormsecurity.com/files/177031/KiTTY-0.76.1.13-Command-Injection.html
- http://seclists.org/fulldisclosure/2024/Feb/13
- http://seclists.org/fulldisclosure/2024/Feb/14
- https://blog.defcesco.io/CVE-2024-23749
- http://packetstormsecurity.com/files/177031/KiTTY-0.76.1.13-Command-Injection.html
- http://seclists.org/fulldisclosure/2024/Feb/13
- http://seclists.org/fulldisclosure/2024/Feb/14
- https://blog.defcesco.io/CVE-2024-23749
