CVE-2024-38395: iTerm2 RCE Vulnerability

CVE-2024-38395 Overview

CVE-2024-38395 is a code injection vulnerability affecting iTerm2, a popular terminal emulator for macOS. The vulnerability exists because the "Terminal may report window title" setting is not properly honored, which could allow remote code execution under certain conditions. While the vulnerability is classified as not trivially exploitable, the potential for remote code execution makes this a significant security concern for developers and system administrators who rely on iTerm2 for their daily workflows.

Critical Impact

Remote code execution vulnerability in iTerm2 before version 3.5.2 due to improper enforcement of security settings related to terminal window title reporting.

Affected Products

• iTerm2 versions prior to 3.5.2
• macOS systems running vulnerable iTerm2 installations

Discovery Timeline

• June 16, 2024 - CVE-2024-38395 published to NVD
• June 18, 2025 - Last updated in NVD database

Technical Details for CVE-2024-38395

Vulnerability Analysis

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code), commonly known as code injection. The flaw resides in iTerm2's handling of terminal escape sequences related to window title reporting. Terminal emulators can respond to certain escape sequences by sending data back to the terminal, which can then be interpreted as commands.

In iTerm2, users have a setting called "Terminal may report window title" that is designed to prevent the terminal from responding to title query escape sequences. However, this security setting was not being properly enforced, meaning malicious content could potentially trigger code execution even when users believed they had disabled this functionality.

The attack scenario involves an attacker crafting malicious content that, when displayed in the terminal, would cause iTerm2 to process escape sequences in an unintended manner. This could occur through various vectors such as viewing malicious files, connecting to compromised servers, or processing untrusted data through the terminal.

Root Cause

The root cause of this vulnerability lies in the improper enforcement of the "Terminal may report window title" configuration setting. The code path responsible for handling terminal escape sequences failed to properly check the user's security preferences before processing window title reporting requests. This allowed escape sequences to be processed regardless of the user's intended security configuration.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction in the worst-case scenario. An attacker could exploit this vulnerability through several methods:

• Embedding malicious escape sequences in files that may be viewed in the terminal (such as through cat, less, or similar commands)
• Compromising a remote server that a user connects to via SSH, allowing the server to send malicious escape sequences
• Crafting malicious content that gets displayed in terminal applications processing untrusted input

The vulnerability mechanism involves terminal escape sequences that query the window title. When the terminal responds to these queries, the response data can be crafted to include executable commands that get interpreted by the shell. For detailed technical analysis, refer to the Openwall OSS Security disclosure.

Detection Methods for CVE-2024-38395

Indicators of Compromise

• Unusual terminal escape sequences appearing in log files or command history
• Unexpected command execution following SSH sessions or file viewing operations
• iTerm2 window titles changing unexpectedly or containing suspicious content
• Network connections initiated from the terminal process without user action

Detection Strategies

• Monitor iTerm2 process behavior for spawning unexpected child processes
• Implement endpoint detection rules that flag suspicious escape sequence patterns in terminal data streams
• Review iTerm2 version across managed macOS endpoints to identify unpatched installations
• Audit command history for anomalous commands that may indicate exploitation attempts

Monitoring Recommendations

• Deploy endpoint detection and response (EDR) solutions capable of monitoring terminal emulator behavior
• Implement application version monitoring to ensure iTerm2 installations are current
• Configure SIEM rules to correlate terminal-related anomalies across the enterprise
• Enable enhanced logging for shell sessions to capture potential exploitation artifacts

How to Mitigate CVE-2024-38395

Immediate Actions Required

• Upgrade iTerm2 to version 3.5.2 or later immediately
• Audit all macOS endpoints for vulnerable iTerm2 installations
• Review any suspicious activity on systems where iTerm2 may have processed untrusted content
• Consider temporarily switching to an alternative terminal emulator if immediate patching is not possible

Patch Information

The vulnerability has been addressed in iTerm2 version 3.5.2. The fix is available through the official iTerm2 downloads page. The specific commit addressing this vulnerability can be reviewed in the GitLab iTerm2 commit log. The release tag is available at the GitLab iTerm2 release page.

Workarounds

• Disable the "Terminal may report window title" setting in iTerm2 Preferences (though this setting was not being honored, it should be disabled as a defense-in-depth measure)
• Avoid viewing untrusted files in the terminal using commands like cat or less until patched
• Exercise caution when connecting to untrusted remote servers via SSH
• Consider using sandboxing or containerization when working with untrusted content

# Verify iTerm2 version from command line
# Navigate to iTerm2 > About iTerm2, or check:
defaults read /Applications/iTerm.app/Contents/Info CFBundleShortVersionString

# Ensure version is 3.5.2 or later
# If outdated, update via Homebrew:
brew update && brew upgrade --cask iterm2

# Or download directly from iterm2.com/downloads.html