CVE-2022-23465: Other (NVD-CWE-Other)
value: SwiftTerm is a Xterm/VT100 Terminal emulator. Prior to commit a94e6b24d24ce9680ad79884992e1dff8e150a31, an attacker could modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands. Version a94e6b24d24ce9680ad79884992e1dff8e150a31 contains a patch for this issue. There are no known workarounds available.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 7.8
Published: 2022-12-02T23:15Z
Repository: https://github.com/migueldeicaza/SwiftTerm
Language: Swift
Files changed: Sources/SwiftTerm/Terminal.swift
Commit date: 2022-12-02 14:31:37 -0500
Commit message: Fix two possible attack vectors, where an attacker can store
information into the termianl and then get to replay it.

Two of those instances are setting the terminal title, and icon title,
and then requesting the values back (see CVE-2003-0063[2] and
https://marc.info/?l=bugtraq&m=104612710031920&w=2 for details).

And another case is sending an invalid DECRQSS sequence, which the
handler would respond back with the results, see here for how this is
used: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510030 CVE-2008-2383[3]

These bugs were found and disclosed by David Leadbeater <dgl@dgl.cx>
(@dgl at Github.com)

Diff: diff --git a/Sources/SwiftTerm/Terminal.swift b/Sources/SwiftTerm/Terminal.swift
index 7f91d88..a13d9fb 100644
--- a/Sources/SwiftTerm/Terminal.swift
+++ b/Sources/SwiftTerm/Terminal.swift
@@ -703,11 +703,13 @@ open class Terminal {
                 result = "\(style) q"
             default:
                 ok = 0 // this means the request is not valid, report that to the host.
                 // invalid: DCS 0 $ r Pt ST (xterm)
                 terminal.log ("Unknown DCS + \(newData!)")
-                result = newData ?? ""
+                // Do not report 'newData', because it can be exploited
+                // see https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510030
+                result = ""
 
             }
             terminal.sendResponse (terminal.cc.DCS, "\(ok)$r\(result)", terminal.cc.ST)
         }
     }
@@ -2636,15 +2638,17 @@ open class Terminal {
                 sendResponse(r)
             } else {
                 sendResponse(cc.CSI, "9;\(rows);\(cols)t")
             }
         case [20]:
-            let it = iconTitle.replacingOccurrences(of: "\\", with: "")
-            sendResponse (cc.OSC, "L\(it)", cc.ST)
+            // Do not report the actual title back, as it can be exploited,
+            // https://marc.info/?l=bugtraq&m=104612710031920&w=2
+            sendResponse (cc.OSC, "L", cc.ST)
         case [21]:
-            let tt = terminalTitle.replacingOccurrences(of: "\\", with: "")
-            sendResponse (cc.OSC, "l\(tt)", cc.ST)
+            // Do not report the actual content of the title back, as it can be exploited,
+            // https://marc.info/?l=bugtraq&m=104612710031920&w=2
+            sendResponse (cc.OSC, "l", cc.ST)
         case [22, 0]:
             terminalTitleStack = terminalTitleStack + [terminalTitle]
             terminalIconStack = terminalIconStack + [iconTitle]
         case [22, 1]:
             terminalIconStack = terminalIconStack + [iconTitle]

Vulnerable code:                 result = newData ?? ""
            let it = iconTitle.replacingOccurrences(of: "\\", with: "")
            sendResponse (cc.OSC, "L\(it)", cc.ST)
            let tt = terminalTitle.replacingOccurrences(of: "\\", with: "")
            sendResponse (cc.OSC, "l\(tt)", cc.ST)
Fixed code:                 // Do not report 'newData', because it can be exploited
                // see https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510030
                result = ""
            // Do not report the actual title back, as it can be exploited,
            // https://marc.info/?l=bugtraq&m=104612710031920&w=2
            sendResponse (cc.OSC, "L", cc.ST)
            // Do not report the actual content of the title back, as it can be exploited,
            // https://marc.info/?l=bugtraq&m=104612710031920&w=2
            sendResponse (cc.OSC, "l", cc.ST)