CVE-2025-22275: iTerm2 Information Disclosure Vulnerability

CVE-2025-22275 Overview

CVE-2025-22275 is a critical information disclosure vulnerability affecting iTerm2, the popular macOS terminal emulator. The vulnerability exists in versions 3.5.6 through 3.5.10 and allows remote attackers to obtain sensitive information from terminal commands by reading the /tmp/framer.txt file. This security flaw can occur under certain it2ssh and SSH Integration configurations when users establish remote logins to hosts that have a common Python installation.

Critical Impact

Sensitive terminal command data may be exposed to unauthorized parties through a world-readable temporary file, potentially compromising credentials, API keys, and other secrets transmitted during SSH sessions.

Affected Products

• iTerm2 versions 3.5.6 through 3.5.10
• Systems using it2ssh or SSH Integration features
• Remote hosts with Python installations accessible via SSH

Discovery Timeline

• 2025-01-03 - CVE-2025-22275 published to NVD
• 2025-06-20 - Last updated in NVD database

Technical Details for CVE-2025-22275

Vulnerability Analysis

This vulnerability is classified under CWE-532 (Insertion of Sensitive Information into Log File), indicating that sensitive data is being written to a location where it should not be stored. The core issue stems from iTerm2's SSH Integration feature writing terminal session data to the /tmp/framer.txt file without proper access controls.

When a user initiates an SSH connection using the affected SSH Integration feature, terminal command data—which may include sensitive information such as passwords, tokens, or confidential output—is temporarily written to this world-readable file in the /tmp directory. Any local user or process on the remote system can potentially read this file and extract sensitive information from ongoing or recent terminal sessions.

The vulnerability has a network-based attack vector, meaning exploitation can be triggered remotely through the SSH connection process, though the actual information extraction requires access to the remote host's filesystem.

Root Cause

The root cause of CVE-2025-22275 lies in improper handling of temporary files within iTerm2's SSH Integration functionality. The application writes frame data to /tmp/framer.txt with insufficient file permission restrictions, allowing other users on the same system to access this sensitive information. This represents a fundamental secure coding violation where temporary files containing sensitive data are created without restrictive permissions or are placed in shared directories accessible to other users.

Attack Vector

The attack scenario involves a malicious actor who has access to a remote host where legitimate users connect via iTerm2's SSH Integration feature. The attacker can monitor or periodically read the /tmp/framer.txt file to capture sensitive terminal data from other users' sessions.

The exploitation flow works as follows:

1. A legitimate user connects to a remote host using iTerm2 with SSH Integration enabled (versions 3.5.6-3.5.10)
2. The remote host has a Python installation that interacts with the SSH Integration feature
3. Terminal session data is written to /tmp/framer.txt with insecure permissions
4. An attacker with local access to the remote host reads the file contents
5. Sensitive information from the victim's terminal session is exposed

For detailed technical information about this vulnerability, refer to the GitLab SSH Integration Leak wiki page.

Detection Methods for CVE-2025-22275

Indicators of Compromise

• Presence of /tmp/framer.txt file on remote systems where SSH Integration is used
• Unauthorized read access attempts to /tmp/framer.txt in system logs
• Unusual processes monitoring or repeatedly accessing the /tmp directory
• Evidence of file watching utilities targeting temporary files

Detection Strategies

• Monitor file system access patterns for repeated reads of /tmp/framer.txt by non-iTerm2 processes
• Implement file integrity monitoring on remote hosts to detect unauthorized access to temporary files
• Review SSH connection logs for connections from iTerm2 versions 3.5.6 through 3.5.10
• Deploy endpoint detection rules to identify processes reading sensitive temporary files in /tmp

Monitoring Recommendations

• Enable auditd or similar file access logging on remote hosts to track access to /tmp/framer.txt
• Configure SentinelOne Singularity to monitor for suspicious file access patterns in temporary directories
• Implement alerting for any iTerm2 SSH Integration activity from vulnerable versions
• Regularly audit remote systems for world-readable files in /tmp containing sensitive data

How to Mitigate CVE-2025-22275

Immediate Actions Required

• Upgrade iTerm2 to version 3.5.11 or later immediately
• Disable SSH Integration feature if immediate upgrade is not possible
• Audit remote systems for the presence of /tmp/framer.txt and remove any instances
• Review access logs on remote hosts for potential unauthorized access to the vulnerable file
• Rotate any credentials or secrets that may have been exposed through SSH sessions during the vulnerable period

Patch Information

The vendor has released iTerm2 version 3.5.11 which addresses this vulnerability. The patch corrects the file permission handling for temporary files used by the SSH Integration feature. Users should update to this version or later to remediate the vulnerability.

For complete patch details, see the iTerm2 3.5.11 Change Log.

Workarounds

• Disable the SSH Integration feature entirely by navigating to iTerm2 Preferences and disabling the SSH Integration option
• Avoid using it2ssh command until the software is updated to a patched version
• Manually delete /tmp/framer.txt after SSH sessions if upgrade is not immediately possible
• Use standard SSH clients instead of iTerm2's integrated SSH functionality until patched

# Check current iTerm2 version
/Applications/iTerm.app/Contents/MacOS/iTerm2 --version

# Remove potentially sensitive temporary file on remote hosts
rm -f /tmp/framer.txt

# Set restrictive permissions if file recreation is necessary
chmod 600 /tmp/framer.txt