CVE-2023-46300: Improper Encoding or Escaping of Output (CWE-116)
value: iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequences related to tmux integration.
CWE description: The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CVSS v3 base score: 9.8
Published: 2023-10-22T04:15Z
Repository: https://github.com/gnachman/iTerm2
Language: Objective-C
Files changed: sources/PTYSession.m, sources/TmuxController.h, sources/TmuxController.m
Commit date: 2023-08-07 21:56:18 -0700
Commit message: Fix for method 1 and 2.

Send ^C as the first character of output when entering tmux integration mode.

Diff: diff --git a/sources/PTYSession.m b/sources/PTYSession.m
index e23d4ecbc..f1ee02a3e 100644
--- a/sources/PTYSession.m
+++ b/sources/PTYSession.m
@@ -7888,10 +7888,11 @@ - (void)tmuxInitialCommandDidCompleteSuccessfully {
 
 // When guessVersion finishes, if you have called openWindowsInitial, then windows will actually get
 // opened. Initial window opening is always blocked on establishing the server version.
 - (void)kickOffTmux {
     _haveKickedOffTmux = YES;
+    [_tmuxController sendControlC];
     [_tmuxController ping];
     [_tmuxController validateOptions];
     [_tmuxController checkForUTF8];
     [_tmuxController loadDefaultTerminal];
     [_tmuxController loadKeyBindings];
diff --git a/sources/TmuxController.h b/sources/TmuxController.h
index 0b59b8542..18ee0eee6 100644
--- a/sources/TmuxController.h
+++ b/sources/TmuxController.h
@@ -129,10 +129,11 @@ extern NSString *const kTmuxControllerDidChangeHiddenWindows;
 - (void)detach;
 - (void)windowDidResize:(NSWindowController<iTermWindowController> *)term;
 - (void)fitLayoutToWindows;
 - (void)validateOptions;
 - (void)ping;
+- (void)sendControlC;
 - (void)enablePauseModeIfPossible;
 - (void)unpausePanes:(NSArray<NSNumber *> *)wps;
 - (void)pausePanes:(NSArray<NSNumber *> *)wps;
 - (void)didPausePane:(int)wp;
 
diff --git a/sources/TmuxController.m b/sources/TmuxController.m
index 9480c2a0f..b10bdccf4 100644
--- a/sources/TmuxController.m
+++ b/sources/TmuxController.m
@@ -1079,10 +1079,18 @@ - (void)setClientSize:(NSSize)size {
                          nil];
     ++numOutstandingWindowResizes_;
     [gateway_ sendCommandList:commands];
 }
 
+- (void)sendControlC {
+    [gateway_ sendCommand:[NSString stringWithFormat:@"%cphony-command", 3]
+           responseTarget:nil
+         responseSelector:nil
+           responseObject:nil
+                    flags:kTmuxGatewayCommandShouldTolerateErrors];
+}
+
 - (void)ping {
     // This command requires tmux 3.2, but if it fails that's OK too.
     [gateway_ sendCommand:@"refresh-client -fpause-after=0,wait-exit"
            responseTarget:self
          responseSelector:@selector(handlePingResponse:)

Fixed code:     [_tmuxController sendControlC];
- (void)sendControlC;
- (void)sendControlC {
    [gateway_ sendCommand:[NSString stringWithFormat:@"%cphony-command", 3]
           responseTarget:nil
         responseSelector:nil
           responseObject:nil
                    flags:kTmuxGatewayCommandShouldTolerateErrors];
}