Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Abusing url handling in iTerm2 and Hyper for code execution

vin01.github.io

Post reply on HN
Print view View original

31–40 of 58 posts

Re: Abusing url handling in iTerm2 and Hyper for code execution

#31

Post by GoblinSlayer »

philsnow wrote: post #16

At the very end of the article, > Upgrade to iTerm2 3.5.0 I had just gotten the upgrade notification for 3.5.0 a few minutes ago. I scrolled through the release notes a bit and got to the "AI" section and I would like very much to get off this ride. I am grumpy and a terminal should be a terminal. Features of iTerm2 I don't use and don't think belong in a terminal emulator: - tmux integration - shell integration - ss…

Huh? Typing passwords would be a nice feature, nicer than the myriad of other ancient teletype control codes. Something like ^p (type password) ^P (return to terminal).

Re: Abusing url handling in iTerm2 and Hyper for code execution

#32

Post by mindajar »

vbezhenar wrote: post #19
philsnow wrote: post #16

At the very end of the article, > Upgrade to iTerm2 3.5.0 I had just gotten the upgrade notification for 3.5.0 a few minutes ago. I scrolled through the release notes a bit and got to the "AI" section and I would like very much to get off this ride. I am grumpy and a terminal should be a terminal. Features of iTerm2 I don't use and don't think belong in a terminal emulator: - tmux integration - shell integration - ss…

Honestly I never understood the need to replace macOS Terminal. I'm heavy terminal user, that's my most used application by far. But macOS Terminal is absolutely fine for my needs and I never felt the need for any additional features.

Terminal.app seems in no hurry to add truecolor support, which is really nice for editor color schemes and other things once you’ve gotten used to it.

Re: Abusing url handling in iTerm2 and Hyper for code execution

#33

Post by sebzim4500 »

philsnow wrote: post #16

At the very end of the article, > Upgrade to iTerm2 3.5.0 I had just gotten the upgrade notification for 3.5.0 a few minutes ago. I scrolled through the release notes a bit and got to the "AI" section and I would like very much to get off this ride. I am grumpy and a terminal should be a terminal. Features of iTerm2 I don't use and don't think belong in a terminal emulator: - tmux integration - shell integration - ss…

If you don't want the terminal to have any features then why don't you just use the default Terminal app?

Re: Abusing url handling in iTerm2 and Hyper for code execution

#34

Post by lmz »

Joker_vD wrote: post #30
vin10 wrote: post #11

Earlier quoted context omitted.

It is the first one, they need to be printed and clicked.

There is also another escape sequence, OSC 1337, apparently already implemented in iTerm2 [0], which makes iTerm2 open the URL instead of printing it: The hypothetical new control code is different because it does not display a hyperlink; it directly opens the link using the appropriate system URL handler. [0] https://gitlab.com/gnachman/iterm2/-/issues/10994

The commit linked there checks host only and not protocol for "always allow". I wonder if that's going to be a problem with some of the more interesting protocols.

Re: Abusing url handling in iTerm2 and Hyper for code execution

#35

Post by arresin »

StableAlkyne wrote: post #9
Groxx wrote: post #5

Earlier quoted context omitted.

It sure is a good thing we never run anything in our terminals without fully vetting all output. curl -s -L https://raw.githubusercontent.com/Groxx/rickrollrc/master/roll.sh | bash

I can't believe curl | sh is still the recommended way to install oh-my-zsh

I like it because you can replace sh with whatever you want to go over the script

Re: Abusing url handling in iTerm2 and Hyper for code execution

#36

Post by knodi123 »

HunterWare wrote: post #25
classified wrote: post #15

I stopped using iTerm2 as soon as I learned it will open arbitrary URLs.

Huh, I just disabled it in Preferences and kept on rolling. This is the other viable option: Settings->Pointer->General and disable cmd-click opens filename/URL.

I enabled it because github's "turn this push into a PR" link is such a timesaver.

Re: Abusing url handling in iTerm2 and Hyper for code execution

#37

Post by vladxyz »

tzs wrote: post #27
Dylan16807 wrote: post #12

Earlier quoted context omitted.

Getting it out of a repository wouldn't make any more vetting appear as if by magic. And if you're facing an attacker sophisticated enough to send different contents to a browser and to curl, then you're probably not going to find their backdoor in the first place. And it would be stupid of them to depend on that trick, so this becomes an extremely niche case not worth worrying about. And multiply that sophistication…

> Getting it out of a repository wouldn't make any more vetting appear as if by magic. But it makes it way easier to figure out what happened if you do get attacked. With "curl | sh" if a compromised site only sends the attack code randomly and I get unlucky I won't have a copy of the attack code afterwards. If I go to the site to grab a copy I'll probably get a copy without the attack code. With "curl > /tmp/foo.$$;…

You can also throw in a `-x` at the end there.

Re: Abusing url handling in iTerm2 and Hyper for code execution

#38

Post by make3 »

philsnow wrote: post #16

At the very end of the article, > Upgrade to iTerm2 3.5.0 I had just gotten the upgrade notification for 3.5.0 a few minutes ago. I scrolled through the release notes a bit and got to the "AI" section and I would like very much to get off this ride. I am grumpy and a terminal should be a terminal. Features of iTerm2 I don't use and don't think belong in a terminal emulator: - tmux integration - shell integration - ss…

people talked about this elsewhere, the AI part is fully optional and disabled by default

Re: Abusing url handling in iTerm2 and Hyper for code execution

#39

Post by omoikane »

Would it help if SSH clients don't pass TERM variable to identify that current terminal is capable of handling "\e]8" ? I assume TERM is how the remote application know that this exploit is available.

I also assume that this vulnerability is meant for remote apps accessed via SSH or similar, since a compromised app that is executed locally probably have easier exploits (they might just run calculator or whatever directly without going through escape sequences, for example).

Re: Abusing url handling in iTerm2 and Hyper for code execution

#40

Post by xvector »

Joker_vD wrote: post #30
vin10 wrote: post #11

Earlier quoted context omitted.

It is the first one, they need to be printed and clicked.

There is also another escape sequence, OSC 1337, apparently already implemented in iTerm2 [0], which makes iTerm2 open the URL instead of printing it: The hypothetical new control code is different because it does not display a hyperlink; it directly opens the link using the appropriate system URL handler. [0] https://gitlab.com/gnachman/iterm2/-/issues/10994

iTerm2 has definitely not been designed with security in mind.

It has a massive and rapidly growing attack surface and quite a bit of feature bloat (literally hundreds of "features") - I would not recommend using it over Terminal for anyone security minded.

Post reply on HN