Skip to content

Shell execution on macOS from arbitrary websites through printAppTitle.scpt

High
ErikBjare published GHSA-3x6w-q32m-jqf3 Jun 17, 2021

Package

aw-watcher-window (ActivityWatch)

Affected versions

<= 0.10.0

Patched versions

0.11.0

Description

Impact

Allows an attacker to execute arbitrary commands on any macOS machine with ActivityWatch running, if they can get the user to open an application (like a web browser) such that it sets the application's window title to a malicious string.

The attacker can exploit this vulnerability by having the user visiting a website with the page title set to a malicious string. An attacker could use another application to accomplish the same, but the web browser is the most likely attack vector.

Patches

A pull request (ActivityWatch/aw-watcher-window#52) has been merged which changes the default method of fetching the window title, and this new method is unaffected. The previous method is still available through configuration, and has also been patched (ActivityWatch/aw-watcher-window#56).

Users should update to v0.11.0 as soon as possible.

Workarounds

Run the latest version of aw-watcher-window from source, or manually patch the printAppTitle.scpt file.

Credit

This vulnerability was discovered by Janne Uusitupa (@lambdanana), and fixes were contributed by Erik Bjäreholt (@ErikBjare).

Severity

High
8.8
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE ID

CVE-2021-32692

Weaknesses

No CWEs

Credits