Slightly off-topic, but...
> Hyper is an Electron-based terminal
Why!?
Abusing url handling in iTerm2 and Hyper for code execution
41–50 of 58 posts
Re: Abusing url handling in iTerm2 and Hyper for code execution
#42> This is of course a harmless PoC and you can try it out using docker pull vin01/escape-seq-test:latest --platform darwin/arm64 or docker run --rm vin01/escape-seq-test and you should see the injected link as shown below. Wow, I wouldn't have expected `docker pull` in particular to allow arbitrary content injection. Does anyone know of any tools which scan images being pulled before passing them over to `docker` for…
I believe skopeo should allow you to: https://github.com/containers/skopeo
Re: Abusing url handling in iTerm2 and Hyper for code execution
#43> Any links using those schemes when clicked, would open the MacOS terminal to perform the corresponding action. I'm unclear which of these are being described: 1: when printed and clicked, they may be handled by the terminal, and the terminal's handling allows more behaviors than it should, allowing code execution 2: when printed, these urls are automatically executed by the shell, allowing code execution Neither ar…
You never want to see raw, attacker-supplied text in a terminal, actually.
Is that realistic?
Sure, text editors and viewers like vim or less can probably filter out terminal escape sequences, but should arbitrary programs printing (potentially user-supplied) strings to stdout have to?
Maybe terminal escape sequence processing should be opt-in (on a by-process/job level) rather than opt-out?
Re: Abusing url handling in iTerm2 and Hyper for code execution
#44Would it help if SSH clients don't pass TERM variable to identify that current terminal is capable of handling "\e]8" ? I assume TERM is how the remote application know that this exploit is available. I also assume that this vulnerability is meant for remote apps accessed via SSH or similar, since a compromised app that is executed locally probably have easier exploits (they might just run calculator or whatever dire…
AFAIK, the remote applications simply do an isatty() check on the stdout and that's it; a proper terminal is then apparently expected to correctly skip and quietly ignore any OSC sequence it does not understand. See the source of ls [0], for example.
[0] https://github.com/coreutils/coreutils/blob/2a72cf1e9959f40b...
Re: Abusing url handling in iTerm2 and Hyper for code execution
#45Would it help if SSH clients don't pass TERM variable to identify that current terminal is capable of handling "\e]8" ? I assume TERM is how the remote application know that this exploit is available. I also assume that this vulnerability is meant for remote apps accessed via SSH or similar, since a compromised app that is executed locally probably have easier exploits (they might just run calculator or whatever dire…
You don't need a "compromised app" if the escape codes are in a file you cat.
Re: Abusing url handling in iTerm2 and Hyper for code execution
#46Earlier quoted context omitted.
Huh, I just disabled it in Preferences and kept on rolling. This is the other viable option: Settings->Pointer->General and disable cmd-click opens filename/URL.
I enabled it because github's "turn this push into a PR" link is such a timesaver.
Yeah, that would be convenient. It feels like users do get the power to choose utility (enable) vs skeeved out (disable), which is all you can ask for =)
Re: Abusing url handling in iTerm2 and Hyper for code execution
#47> This is of course a harmless PoC and you can try it out using docker pull vin01/escape-seq-test:latest --platform darwin/arm64 or docker run --rm vin01/escape-seq-test and you should see the injected link as shown below. Wow, I wouldn't have expected `docker pull` in particular to allow arbitrary content injection. Does anyone know of any tools which scan images being pulled before passing them over to `docker` for…
> I wouldn't have expected `docker pull` in particular to allow arbitrary content injection.
Having read Docker source code and seen a repetitive pattern of silly mistakes with dire consequences, I emphatically would expect it to have such, and many other similar, issues.
My personal favorite is still the time they computed a hash of a download, but then failed to compare it to anything.
Re: Abusing url handling in iTerm2 and Hyper for code execution
#48Earlier quoted context omitted.
I know I prefer my exploits to come from opaque corners of package formats or docker layers as bofh intended. The more indirect handoffs of trust the merrier.
Docker is at least sandboxed by default and requires sudo password to run commands.
There are advantages to docker, but also disadvantages. Definitely the same w/ "curl | sh" That's all I was trying to allude to, tongue in cheek.
Re: Abusing url handling in iTerm2 and Hyper for code execution
#49I stopped using iTerm2 as soon as I learned it will open arbitrary URLs.
It will only open the URLs after presenting a confirmation banner that says: "open this URL? http://example.com/", or if you command-click on a link.
Re: Abusing url handling in iTerm2 and Hyper for code execution
#50Earlier quoted context omitted.
It is the first one, they need to be printed and clicked.
There is also another escape sequence, OSC 1337, apparently already implemented in iTerm2 [0], which makes iTerm2 open the URL instead of printing it: The hypothetical new control code is different because it does not display a hyperlink; it directly opens the link using the appropriate system URL handler. [0] https://gitlab.com/gnachman/iterm2/-/issues/10994
It is guarded by a warning and requires explicit approval similar to browsers but yes, it does broaden the attack surface: https://gitlab.com/gnachman/iterm2/-/commit/fc9ae5c90f53cb1e...