4 ms·

I’ve always been curious though, can VT escape sequences be used to perform user actions? E.g. can you coerce stdout to execute an additional command?

yencabulator 4y ago
TTY emulators have a long history of being vulnerable to all kinds of nasty things. For example: https://seclists.org/fulldisclosure/2003/Feb/att-341/Termulation.txt https://seclists.org/fulldisclosure/2003/Feb/att-341/Termula... One would hope that we're past the bad times, but at the same time brand new projects like the kitty terminal emulator let stdout read and delete arbitrary files. And verifying something is safe is just hard, these are not even e.g. memory safety bugs, they're "features".
- aumerle 4y ago
  No, kitty does not let stdout out read or delete arbitrary files. First of all stdout is an integer in a lookup table in your kernel, It cant read or delete anything. I assume you mean it lets programs read or delete arbitrary files by writing to and reading from the tty device. And even that is not true. The kitty graphics protocol does let a program delete arbitrary files in the TEMP directory. It does not let anyone either read or list the contents of any part of the filesystem.
  - yencabulator 4y ago
    > First of all stdout is an integer in a lookup table in your kernel, It cant read or delete anything. Oh come on, you know what everyone means. "Output with potentially hostile content". Right now it seems kitty will happily delete e.g. /tmp/.X11-unix/X0. That sounds fun. https://sw.kovidgoyal.net/kitty/graphics-protocol/#the-transmission-medium https://sw.kovidgoyal.net/kitty/graphics-protocol/#the-trans... https://github.com/kovidgoyal/kitty/blob/5541e3c2ff441aea31940924ff952c968a77a30e/kitty/graphics.c#L423-L424 https://github.com/kovidgoyal/kitty/blob/5541e3c2ff441aea319...
    - aumerle 4y ago
      Everyone?? No just you. And read the rest of my post. Yes, kitty will delete files in /tmp if asked to. That's what I said. And no unlike your claim, it does not read them. If you cannot tolerate the theoretical possibility of something deleting a file in /tmp ever, then set TEMP before you launch kitty to /tmp/my-mommy-told-me-not-to-put-valuable-things-in-tmp-but-i-didnt-listen
      - yencabulator 4y ago
        Holy excessive combativeness, Batman! > And no unlike your claim, it does not read them. strace -e open,openat kitty printf '\e_Gf=24,s=10,v=20,t=f;%s\e\\' "$(echo -n /etc/passwd|base64)" openat(AT_FDCWD, "/etc/passwd", O_RDONLY|O_CLOEXEC) = 14
        aumerle 4y ago
        Are you being deliberately obtuse? Yes obviously when asked to display a file, kitty will read it. But it wont send the file contents on the TTY, so the *program sending the request* cannot read it. Which is what we are discussing here. You are trying to make it seem like the ability of a program to get kitty to read an arbitrary file is a security issue. I suggest you go do the following: strace your editor, then ask it to open /etc/passwd, and then be shocked when you see it doing so in the strace log. Seriously, why am I wasting time replying to you.
        yencabulator 4y ago
        I'm trying to make it seem like kitty doesn't have very strong security boundaries, and it's a bit of unknown what it can and cannot be made to do. Me asking my editor to open /etc/passwd is me asking my editor to do something. My terminal emulator opening files and parsing them and deleting them just because I viewed untrusted content is something different. If you want to make that argument, you need to come up with an example where my editor accesses attacker-controlled files because I opened a random README.md. Also, please read https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html, and shove your attitude.
jhallenworld 4y ago
There is a thing called the answerback message: computer sends Ctrl-E (0x05, "ENQ"), and the terminal response with the pre-programmed answerback message. Maybe the message is a shell command, like "rm -rf *" or "chmod a+rwx ." You can program this message in the setup screen of the terminal. Maybe you can set up all the terminals in the computer center at night... You can send Ctrl-E to a user with "write" or "wall".. This answerback message is actually really old, exists even in mechanical ASR-33 teletypes: https://en.wikipedia.org/wiki/Enquiry_character https://en.wikipedia.org/wiki/Enquiry_character It can also be triggered by the mysterious "here is" key on the ADM-3A. https://dave.cheney.net/2017/08/21/the-here-is-key https://dave.cheney.net/2017/08/21/the-here-is-key
- tinus_hn 4y ago
  I think you can also request the terminal type and at some point you could also request the title of the window in some terminals. Which is why it’s not just annoying but also dangerous to output untrusted characters to the terminal without a filter.

yencabulator 4y ago

TTY emulators have a long history of being vulnerable to all kinds of nasty things. For example: https://seclists.org/fulldisclosure/2003/Feb/att-341/Termulation.txt https://seclists.org/fulldisclosure/2003/Feb/att-341/Termula... One would hope that we're past the bad times, but at the same time brand new projects like the kitty terminal emulator let stdout read and delete arbitrary files. And verifying something is safe is just hard, these are not even e.g. memory safety bugs, they're "features".

aumerle 4y ago
No, kitty does not let stdout out read or delete arbitrary files. First of all stdout is an integer in a lookup table in your kernel, It cant read or delete anything. I assume you mean it lets programs read or delete arbitrary files by writing to and reading from the tty device. And even that is not true. The kitty graphics protocol does let a program delete arbitrary files in the TEMP directory. It does not let anyone either read or list the contents of any part of the filesystem.
- yencabulator 4y ago
  > First of all stdout is an integer in a lookup table in your kernel, It cant read or delete anything. Oh come on, you know what everyone means. "Output with potentially hostile content". Right now it seems kitty will happily delete e.g. /tmp/.X11-unix/X0. That sounds fun. https://sw.kovidgoyal.net/kitty/graphics-protocol/#the-transmission-medium https://sw.kovidgoyal.net/kitty/graphics-protocol/#the-trans... https://github.com/kovidgoyal/kitty/blob/5541e3c2ff441aea31940924ff952c968a77a30e/kitty/graphics.c#L423-L424 https://github.com/kovidgoyal/kitty/blob/5541e3c2ff441aea319...
  - aumerle 4y ago
    Everyone?? No just you. And read the rest of my post. Yes, kitty will delete files in /tmp if asked to. That's what I said. And no unlike your claim, it does not read them. If you cannot tolerate the theoretical possibility of something deleting a file in /tmp ever, then set TEMP before you launch kitty to /tmp/my-mommy-told-me-not-to-put-valuable-things-in-tmp-but-i-didnt-listen
    - yencabulator 4y ago
      Holy excessive combativeness, Batman! > And no unlike your claim, it does not read them. strace -e open,openat kitty printf '\e_Gf=24,s=10,v=20,t=f;%s\e\\' "$(echo -n /etc/passwd|base64)" openat(AT_FDCWD, "/etc/passwd", O_RDONLY|O_CLOEXEC) = 14
      - aumerle 4y ago
        Are you being deliberately obtuse? Yes obviously when asked to display a file, kitty will read it. But it wont send the file contents on the TTY, so the *program sending the request* cannot read it. Which is what we are discussing here. You are trying to make it seem like the ability of a program to get kitty to read an arbitrary file is a security issue. I suggest you go do the following: strace your editor, then ask it to open /etc/passwd, and then be shocked when you see it doing so in the strace log. Seriously, why am I wasting time replying to you.
        yencabulator 4y ago
        I'm trying to make it seem like kitty doesn't have very strong security boundaries, and it's a bit of unknown what it can and cannot be made to do. Me asking my editor to open /etc/passwd is me asking my editor to do something. My terminal emulator opening files and parsing them and deleting them just because I viewed untrusted content is something different. If you want to make that argument, you need to come up with an example where my editor accesses attacker-controlled files because I opened a random README.md. Also, please read https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html, and shove your attitude.

jhallenworld 4y ago

There is a thing called the answerback message: computer sends Ctrl-E (0x05, "ENQ"), and the terminal response with the pre-programmed answerback message. Maybe the message is a shell command, like "rm -rf *" or "chmod a+rwx ." You can program this message in the setup screen of the terminal. Maybe you can set up all the terminals in the computer center at night... You can send Ctrl-E to a user with "write" or "wall".. This answerback message is actually really old, exists even in mechanical ASR-33 teletypes: https://en.wikipedia.org/wiki/Enquiry_character https://en.wikipedia.org/wiki/Enquiry_character It can also be triggered by the mysterious "here is" key on the ADM-3A. https://dave.cheney.net/2017/08/21/the-here-is-key https://dave.cheney.net/2017/08/21/the-here-is-key

tinus_hn 4y ago
I think you can also request the terminal type and at some point you could also request the title of the window in some terminals. Which is why it’s not just annoying but also dangerous to output untrusted characters to the terminal without a filter.