procs Command Injection via Unsanitized Escape Sequences

Executive Summary

This vulnerability exists in the procs tool versions up to 0.14.12. It fails to sanitize escape sequences in process command lines before displaying them in the Command column. Local attackers can inject malicious ANSI or OSC escape sequences into command arguments, which are then shown unmodified to other users' terminals. Terminal emulators may interpret these sequences, potentially leading to unintended actions.

Useful 0 Not Useful 0

Detection Guidance

Check if you are running procs version 0.14.12 or earlier. Run 'procs --version' to verify. Inspect terminal output for unfiltered escape sequences in the Command column. Test with a harmless OSC 52 sequence: create a process with 'echo -e "\x1b]52;c;dGVzdA==\x07"' in its command line and check if it appears unmodified in procs output.

Useful 0 Not Useful 0

Impact Analysis

If you use the procs tool on a shared or multi-user system, an attacker with local access could craft a process command line containing malicious escape sequences. When you run procs, these sequences may be displayed and interpreted by your terminal emulator, potentially allowing actions like clipboard manipulation or other terminal-based exploits.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade procs to a version that includes the sanitization fix (e.g., commit a064cec or later). If upgrading is not possible, avoid using procs in multi-user environments or restrict its use to trusted users. Monitor for suspicious terminal behavior when running procs.

Useful 0 Not Useful 0