CVE-2022-23465 (published 2022-12-02T23:15Z)

SwiftTerm is a Xterm/VT100 Terminal emulator. Prior to commit a94e6b24d24ce9680ad79884992e1dff8e150a31, an attacker could modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands. Version a94e6b24d24ce9680ad79884992e1dff8e150a31 contains a patch for this issue. There are no known workarounds available.

CVSS v3 base score: 7.8, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/migueldeicaza/SwiftTerm
commit_details: repo_url: https://github.com/migueldeicaza/SwiftTerm
author: Miguel de Icaza
author_date: 2022-12-02 14:20:57-05:00
msg: Fix two possible attack vectors, where an attacker can store
information into the termianl and then get to replay it.

Two of those instances are setting the terminal title, and icon title,
and then requesting the values back (see CVE-2003-0063[2] and
https://marc.info/?l=bugtraq&m=104612710031920&w=2 for details).

And another case is sending an invalid DECRQSS sequence, which the
handler would respond back with the results, see here for how this is
used: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510030 CVE-2008-2383[3]

These bugs were found and disclosed by David Leadbeater <dgl@dgl.cx>
(@dgl at Github.com)
repository: repo_url: https://github.com/migueldeicaza/SwiftTerm
repo_name: migueldeicaza/SwiftTerm
description: Xterm/VT100 Terminal emulator in Swift
repo_language: Swift
owner: migueldeicaza
file_changes: filename: Terminal.swift
change_type: ModificationType.MODIFY
diff: @@ -705,7 +705,9 @@ open class Terminal {
                 ok = 0 // this means the request is not valid, report that to the host.
                 // invalid: DCS 0 $ r Pt ST (xterm)
                 terminal.log ("Unknown DCS + \(newData!)")
-                result = newData ?? ""
+                // Do not report 'newData', because it can be exploited
+                // see https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510030
+                result = ""
 
             }
             terminal.sendResponse (terminal.cc.DCS, "\(ok)$r\(result)", terminal.cc.ST)
@@ -2638,11 +2640,13 @@ open class Terminal {
                 sendResponse(cc.CSI, "9;\(rows);\(cols)t")
             }
         case [20]:
-            let it = iconTitle.replacingOccurrences(of: "\\", with: "")
-            sendResponse (cc.OSC, "L\(it)", cc.ST)
+            // Do not report the actual title back, as it can be exploited,
+            // https://marc.info/?l=bugtraq&m=104612710031920&w=2
+            sendResponse (cc.OSC, "L", cc.ST)
         case [21]:
-            let tt = terminalTitle.replacingOccurrences(of: "\\", with: "")
-            sendResponse (cc.OSC, "l\(tt)", cc.ST)
+            // Do not report the actual content of the title back, as it can be exploited,
+            // https://marc.info/?l=bugtraq&m=104612710031920&w=2
+            sendResponse (cc.OSC, "l", cc.ST)
         case [22, 0]:
             terminalTitleStack = terminalTitleStack + [terminalTitle]
             terminalIconStack = terminalIconStack + [iconTitle]

programming_language: Swift