CVE-2024-38396: iTerm2 RCE Vulnerability

CVE-2024-38396 Overview

CVE-2024-38396 is a code injection vulnerability in iTerm2 versions 3.5.x prior to 3.5.2. The vulnerability stems from unfiltered use of an escape sequence used to report window titles, which when combined with iTerm2's built-in tmux integration feature (enabled by default), allows an attacker to inject arbitrary code into the terminal. This vulnerability is distinct from CVE-2024-38395, which addresses a related but separate escape sequence issue.

Critical Impact

This vulnerability allows remote code execution through specially crafted terminal escape sequences, potentially enabling complete system compromise when a user views malicious content in iTerm2 with tmux integration enabled.

Affected Products

• iTerm2 3.5.x versions prior to 3.5.2
• macOS systems running vulnerable iTerm2 versions with tmux integration enabled (default configuration)

Discovery Timeline

• June 16, 2024 - CVE-2024-38396 published to NVD
• June 20, 2025 - Last updated in NVD database

Technical Details for CVE-2024-38396

Vulnerability Analysis

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code - Code Injection). The flaw exists in how iTerm2 processes terminal escape sequences, specifically those related to window title reporting. Terminal emulators use escape sequences to perform various functions including setting window titles, changing colors, and interacting with the shell environment.

The attack requires no user interaction beyond viewing content containing the malicious escape sequence, and can be triggered over the network through various vectors such as SSH sessions, curl/wget commands, or simply displaying malicious file contents. The tmux integration feature, which is enabled by default in iTerm2, creates the conditions necessary for the escape sequence to be interpreted in a way that enables code injection.

Root Cause

The root cause lies in insufficient sanitization of escape sequences used to report window titles. When iTerm2's tmux integration processes these escape sequences, it fails to properly filter potentially dangerous characters or sequences, allowing an attacker to break out of the intended context and inject arbitrary commands that are then executed by the terminal.

Attack Vector

The attack can be delivered through network-based vectors without requiring authentication or user interaction. An attacker can embed malicious escape sequences in:

• Files that might be displayed using cat, less, or other utilities
• SSH banners or MOTD files on compromised servers
• Web content retrieved via command-line tools like curl or wget
• Log files or any other content that may be viewed in the terminal

When the victim's iTerm2 terminal processes the malicious escape sequence with tmux integration active, the injected code is executed with the privileges of the user running the terminal session. The vulnerability mechanism involves the terminal's window title reporting functionality being abused to inject commands that escape the normal escape sequence processing boundaries.

Detection Methods for CVE-2024-38396

Indicators of Compromise

• Unexpected terminal commands appearing in shell history that the user did not type
• Unusual escape sequences in terminal output, particularly those involving window title manipulation (OSC sequences starting with \\x1b])
• Unexplained process execution or network connections initiated from terminal sessions
• Suspicious activity originating from tmux sessions or iTerm2 processes

Detection Strategies

• Monitor for unusual escape sequence patterns in network traffic destined for terminal sessions
• Implement logging of terminal input/output to detect injection patterns
• Review shell history files for commands that users report not executing
• Deploy endpoint detection rules for suspicious child processes spawned by iTerm2

Monitoring Recommendations

• Enable enhanced logging for iTerm2 sessions in enterprise environments
• Monitor file integrity of commonly viewed files that could be vectors for attack
• Implement network monitoring for known malicious escape sequence patterns
• Consider deploying SentinelOne Singularity XDR for real-time behavioral analysis of terminal emulator processes

How to Mitigate CVE-2024-38396

Immediate Actions Required

• Update iTerm2 to version 3.5.2 or later immediately from the iTerm2 Official Downloads page
• If immediate patching is not possible, disable tmux integration in iTerm2 preferences
• Avoid viewing untrusted content in terminal sessions until patched
• Review recent terminal activity for signs of compromise

Patch Information

The vendor has addressed this vulnerability in iTerm2 version 3.5.2. The fix involves properly filtering escape sequences to prevent code injection through the window title reporting mechanism. The specific commit addressing this issue is available in the GitLab iTerm2 Commit Update.

Organizations should prioritize this update given the network-based attack vector and default vulnerable configuration. The patch ensures that escape sequences used for window title reporting are properly sanitized before being processed by the tmux integration feature.

Workarounds

• Disable tmux integration in iTerm2 by navigating to Preferences → General → tmux and unchecking "Enable tmux integration"
• Use alternative terminal emulators until iTerm2 can be updated
• Implement network filtering to block known malicious escape sequence patterns at the perimeter
• Avoid SSH connections to untrusted or potentially compromised systems until patched

# Verify iTerm2 version (run from Applications folder)
/Applications/iTerm.app/Contents/MacOS/iTerm2 --version

# Check if tmux integration is enabled (look for tmux-related settings)
defaults read com.googlecode.iterm2 | grep -i tmux

# To manually disable tmux integration via command line
defaults write com.googlecode.iterm2 NoSyncTmuxSupport -bool false