Re: Terminal escape sequences - the new XSS for admins?

[Steve Grubb <sgrubb () redhat com>]

On Tuesday, August 11, 2015 04:13:48 PM Daniel Kahn Gillmor wrote:
> On Tue 2015-08-11 12:23:59 -0400, Kurt Seifried wrote:
> > So we've had a bunch of this stuff over the years:
> >
> > http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=terminal+escape
> >
> > And now more recently:
> >
> > http://turbochaos.blogspot.ca/2014/08/journalctl-terminal-escape-injection
> > .html https://bugzilla.redhat.com/show_bug.cgi?id=1084577
> >
> > And we have at least one more coming down the pipeline that's pretty
> > widespread.
> >
> > Also I'm thinking of all those docker apps that log to STDOUT.
> >
> > So the basic TL;DR: please don't use really ancient terminal programs that
> > are vulnerable to this stuff. It appears in testing that most (all?) of
> > the
> > Red Hat stuff is ok, but I can't speak for other vendors.
>
> Do we have a catalog of terminal programs that are vulnerable, or of
> particularly dangerous escape sequences to test with each terminal
> emulator?

echo $'\e[30m'   - turns foreground black (used to trick people by hiding 
text)
echo $'\e]2;ls -al\a' - set window title to 'ls -al'
echo $'\e[21t' - print the window title to the command prompt. This is the one 
to watch out for.

In my survey recently, Some emulators could set the window title; none of them 
supported reading the window title back to the command prompt. If you find one 
that does, it is one that is at risk.

Also note that an attempt to foil or make it hard to set window titles is in 
bashrc under something called PROMPT_COMMAND. You may have to export 
PROMPT_COMMAND="" and then start a new shell to launch the terminal windows.

In my survey over the weekend, I used Fedora 22 and tested the following:

xterm - not vulnerable
gnome-terminal - not vulnerable
konsole - not vulnerable
terminator - not vulnerable.
qterminal - not vulnerable (Undecodable sequence: \001b(hex)[21t)
Eterm - not vulnerable
rxvt - not vulnerable
st - not vulnerable (erresc: unknown csi ESC[21t)
lilyterm - not vulnerable
sakura - not vulnerable
caja-terminal - not vulnerable
xfce4-terminal - not vulnerable
roxterm - not vulnerable
mate-terminal - not vulnerable
termit - not vulnerable

A lot were based on the vte package. So, I dug into the vte package. In the 
file, vteseq.c, is this:

                case 21:
                        /* Report a static window title, since the real
                           window title should NEVER be reported, as it
                           creates a security vulnerability.  See
                           http://marc.info/?l=bugtraq&m=104612710031920&w=2
                           and CVE-2003-0070. */
                        _vte_debug_print(VTE_DEBUG_PARSE,
                                        "Reporting fake window title.\n");
                        /* never use terminal->window_title here! */
                        g_snprintf (buf, sizeof (buf),
                                    _VTE_CAP_OSC "lTerminal" _VTE_CAP_ST);
                        vte_terminal_feed_child(terminal, buf, -1);
                        break;

At this point, I was convinced that most major emulators are safe. That 
said...there are all the ones I didn't check including older ones. The older 
ones are likely to be the ones I'd be most concerned about.

-Steve


> I'd be happy to try to organize a torches-and-pitchforks run
> through the debian archive if i know what to look for.
>
> https://security.stackexchange.com/questions/56307/can-cat-ing-a-file-be-a-p
> otential-security-risk
>
> has some good links and discussion from just last year but nothing
> systematized that i can see.
>
>    --dkg