3 ms·
Would it help if SSH clients don't pass TERM variable to identify that current terminal is capable of handling "\e]8" ? I assume TERM is how the remote applica
by omoikane 2y ago
Would it help if SSH clients don't pass TERM variable to identify that current terminal is capable of handling "\e]8" ? I assume TERM is how the remote application know that this exploit is available.
I also assume that this vulnerability is meant for remote apps accessed via SSH or similar, since a compromised app that is executed locally probably have easier exploits (they might just run calculator or whatever directly without going through escape sequences, for example).
- Joker_vD 2y agoAFAIK, the remote applications simply do an isatty() check on the stdout and that's it; a proper terminal is then apparently expected to correctly skip and quietly ignore any OSC sequence it does not understand. See the source of ls [0], for example. [0] https://github.com/coreutils/coreutils/blob/2a72cf1e9959f40bba5292a62174ff9c97d08671/src/ls.c#L2186 https://github.com/coreutils/coreutils/blob/2a72cf1e9959f40b...
- yencabulator 2y agoYou don't need a "compromised app" if the escape codes are in a file you cat.