CVE-2024-38395
📋 TL;DR
This vulnerability in iTerm2 allows remote code execution when the 'Terminal may report window title' setting is not properly enforced. Attackers could potentially execute arbitrary code on affected systems by manipulating terminal window titles. All users of iTerm2 versions before 3.5.2 are affected.
💻 Affected Systems
- iTerm2
📦 What is this software?
Iterm2 by Iterm2
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with remote code execution leading to complete control of the affected system.
Likely Case
Limited code execution in user context, potentially leading to data theft or lateral movement.
If Mitigated
No impact if the vulnerable setting is disabled or the system is patched.
🎯 Exploit Status
The vulnerability exists but is described as 'not trivially exploitable' in the CVE description.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.5.2
Vendor Advisory: https://iterm2.com/downloads.html
Restart Required: Yes
Instructions:
1. Download iTerm2 version 3.5.2 or later from https://iterm2.com/downloads.html
2. Install the new version
3. Restart iTerm2
🔧 Temporary Workarounds
Disable window title reporting
allDisable the vulnerable 'Terminal may report window title' setting
🧯 If You Can't Patch
- Disable the 'Terminal may report window title' setting in iTerm2 preferences
- Restrict network access to iTerm2 sessions from untrusted sources
🔍 How to Verify
Check if Vulnerable:
Check iTerm2 version in Preferences > General > AboutCheck Version:
iTerm2 > Preferences > General > AboutVerify Fix Applied:
Verify version is 3.5.2 or later in Preferences > General > About📡 Detection & Monitoring
Log Indicators:
- Unusual terminal window title changes
- Suspicious process execution from terminal sessions
Network Indicators:
- Unusual network connections originating from terminal sessions
SIEM Query:
Process execution events with parent process containing 'iTerm' and version < 3.5.2🔗 References
- http://www.openwall.com/lists/oss-security/2024/06/17/1
- https://gitlab.com/gnachman/iterm2/-/commit/f1e89f78dd72dcac3ba66d3d6f93db3f7f649219
- https://gitlab.com/gnachman/iterm2/-/tags/v3.5.2
- https://iterm2.com/downloads.html
- https://www.openwall.com/lists/oss-security/2024/06/15/1
- http://www.openwall.com/lists/oss-security/2024/06/17/1
- https://gitlab.com/gnachman/iterm2/-/commit/f1e89f78dd72dcac3ba66d3d6f93db3f7f649219
- https://gitlab.com/gnachman/iterm2/-/tags/v3.5.2
- https://iterm2.com/downloads.html
- https://www.openwall.com/lists/oss-security/2024/06/15/1
