Skip to content

Shell execution on macOS from arbitrary websites through printAppTitle.scpt

High
ErikBjare published GHSA-3x6w-q32m-jqf3 Jun 17, 2021

Package

aw-watcher-window (ActivityWatch)

Affected versions

<= 0.10.0

Patched versions

0.11.0

Description

Impact

Allows an attacker to execute arbitrary commands on any macOS machine with ActivityWatch running, if they can get the user to open an application (like a web browser) such that it sets the application's window title to a malicious string.

The attacker can exploit this vulnerability by having the user visiting a website with the page title set to a malicious string. An attacker could use another application to accomplish the same, but the web browser is the most likely attack vector.

Patches

A pull request (ActivityWatch/aw-watcher-window#52) has been merged which changes the default method of fetching the window title, and this new method is unaffected. The previous method is still available through configuration, and has also been patched (ActivityWatch/aw-watcher-window#56).

Users should update to v0.11.0 as soon as possible.

Workarounds

Run the latest version of aw-watcher-window from source, or manually patch the printAppTitle.scpt file.

Credit

This vulnerability was discovered by Janne Uusitupa (@lambdanana), and fixes were contributed by Erik Bjäreholt (@ErikBjare).

Severity

High

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE ID

CVE-2021-32692

Weaknesses

No CWEs

Credits