Critical RCE Vulnerability Found in iTerm2 MacOS Terminal Emulator App

A security audit sponsored by the Mozilla Open Source Support Program (MOSS) discovered a critical Remote Code Execution (RCE) vulnerability in the iTerm2 macOS terminal emulator app. iTerm2 is a popular open-source alternative for the built-in Terminal app on macOS.

Terminal apps are prominently used by system administrators, developers, IT staff and also security teams for various operations. The 7-year old critical RCE flaw, tracked as CVE-2019-9535 exists in the tmux integration feature of iTerm2.

A cyber attacker can execute arbitrary commands by providing malicious output to the terminal. The potential attack vectors for this vulnerability include connecting to an attacker-controlled malicious SSH server, using commands like curl to fetch a malicious website, or using tail -f to follow a log file containing some malicious content.

“Typically, this vulnerability would require some degree of user interaction or trickery, but because it can be exploited via commands generally considered safe, there is a high degree of concern about the potential impact,” Mozilla warns.

The vulnerability in the iTerm2 macOS terminal emulator app affects versions up to and including 3.3.5. It has recently been patched with the release of iTerm2 3.3.6. Users can download it manually or check for updates in their installed apps menu.

Processing untrusted data is a primary source of vulnerability in most applications. But for apps like iTerm2, it cannot be avoided because one of its main features is connecting to and loading files from remote servers. So deploying patches as soon as possible is important when flaws are found in such apps.

Written by

Nash N Sulthan

Cyber Security Lead Engineer