Terminal2Shell: Critical flaw grants instant shell access on every major OS

148 points by whjms

jana

WOW 11.0 cvss, scary!!

whjms

I believe even Linus Torvalds's machine has been compromised.
- mxuribe
  
  And, its worse, because like those "Scream" horror movies, the insecure call came from inside the terminal! Eeek! /s
prussian

It's actually 12 in light of sudo -i being usable.

misty

Every serious vulnerability needs a logo, a domain, and a name ending in a number followed by a noun. This one has all three, so it must be serious.

Perfect.

bityard

I don't get out of bed for CVEs that don't have their own theme song.
- gnafuthegreat
  
  To the tune of MC Hammer's "2 Legit 2 Quit":
  
  🎶️ Term-in-al, term-in-al 2 shell!
  Term-in-al, term-in-al 2 shell!
  Term-in-al, term-in-al 2 shell!
  Term-in-al, term-in-al 2 shell!
  
  Sweat runnin' all over my hands
  I don't quit, no, I just press
  "Enter" on my ergo keyboard 🎶️
  
  Et cetera.
- wgx
  
  What was the one a few (many) years back that did have a song? I remember the vocals were text-to-speech. It’s driving me crazy trying to recall it!
classichasclass

Whew. Mac OS 9 is OK.
- wrs
  
  On the other hand, my Apple //e enters this state right away when powered up. Zero-click vulnerability!
- jjuran
  
  Are you sure? MacRelix, I'm sad to say, is vulnerable to this, and I don't have the first clue how to go about fixing it. Even MPW (Macintosh Programmer's Workshop) is exploitable! Fortunately, though, ToolServer is immune. So far.
  - SoapDog
    
    MPW... I was there, 3000 years ago.
  - classichasclass
    
    Well, if we're counting that, then MachTen is also busted. ;)
- kel
  
  I wish my terminal opened in 0ms
  - adam_d_ruppe
    
    mine is like 10ms feels just about instant. terminal, window manager, and shell working together to work well. I did briefly see lag on the shell prompt appearing and turns out it was because work forced me to install node.js and it modified my .bashrc to preload itself which i just deleted and found joy again.
    
    kel
    
    That is infinity times slower than 0ms, however
  - andyc
    
    I AM PANICKING, this has been used against me every day for decades !!
  - ianloic
    
    I keep my computers powered down to mitigate this.
  - david_chisnall
    
    This isn’t actually true. On macOS, by default, the terminal runs with reduced privileges. You have to explicitly grant it the ability to access specific folders.
    
    Practically speaking, anyone who routinely uses a terminal does this because otherwise it doesn’t work.
    
    kwas
    
    Myself I keep my terminal.app plain, with bare zsh, and Full Disc Access, and only use it for OS privileged ops. Everything else I do via another terminal without FDA or other grants.
  - deejayy
    
    Chefs kiss this is.
  - ryan-duve
    
    Typing ls in the proof of concept block got me.
    
    makishimu
    
    cat is another one.
  - mxuribe
    
    Honestly, this is brilliantly hilarious! Kudos to whomever built this!
  - loige
    
    I didn’t find this funny at first… then I tried my compromised terminal, run some commands and the output was actually hilarious! Even the FAQ deserve a read!
  - ubernostrum
    
    Sort-of related: I suggested a joking name for the broader "(thing)2shell" category of vulnerability branding in a group chat, and someone went and made the site.
    
    gnafuthegreat
    
    I'm bracing myself for Shellgate.
  - marginalia
    
    Shitpost social commenary is only as good as the amount of effort that has been put into it. This one was pretty good.
  - mxuribe
    
    Bad news; I used some AI clanker to craft a version of Doom that has Microsoft Paint embedded inside of it and then implanted a terminal shell inside of that MS Paint...so now, even MS Paint - at least under this circumstance - is also vulnerable. Hello and very sorry world! /s
  - dlowe
    
    Classic MacOS wins again.
    
    jjuran
    
    Not so fast — terminals do exist for Mac OS 9, and therefore it too is affected.
  - sjamaan
    
    Looks like multiple people had the same idea. I saw ssh2rce pop up as well today.
  - LenFalken
    
    cooked
  - rainbow_bird
    
    Luckily MS Paint is safe. That's a load-bearing component.
  - taal
    
    I guess the folks that moved their shell to Arcan still don't get their (long overdue) bragging rights for leaving terminal emulation behind them:
    
    https://arcan-fe.com/2025/01/27/sunsetting-cursed-terminal-emulation