gdu Terminal Escape Sequence Injection in Directory Names

Executive Summary

gdu does not remove terminal escape sequences from directory and file names when displaying paths after exiting the terminal user interface. Attackers can create malicious names with escape sequences that alter terminal behavior, such as spoofing window titles or manipulating clipboard content.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by inspecting directory and file names for terminal escape sequences. Use commands like 'ls -R | cat -v' or 'find . -print | grep -P "\x1b"' to identify paths containing escape characters. Review terminal output for unexpected title changes or clipboard actions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to trick users into performing unintended actions by manipulating terminal output. For example, a crafted file name might change the terminal title to mimic a trusted application or alter clipboard contents to insert malicious commands.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it involves terminal escape sequence manipulation rather than data exposure or privacy violations. However, if malicious directory names are used to deceive users into performing actions that lead to unauthorized data access, it could indirectly contribute to compliance violations depending on the context of use.

Useful 0 Not Useful 0

Mitigation Strategies

Update gdu to the latest version to patch the escape sequence handling issue. Avoid opening untrusted directories or files in terminals. Use tools like 'sed' or 'tr' to sanitize filenames if necessary. Monitor terminal behavior for suspicious activity.

Useful 0 Not Useful 0