Introduction to the Vulnerability

• A significant SSH vulnerability was discovered in iTerm 2, a popular terminal for macOS.
• The issue affects specific niche configurations and has been patched as of January 2, 2025.

Details of the Vulnerability

• The vulnerability involves a bug in the SSH integration feature that logs input and output to a text file (temp framer.txt) on the remote host.
• This file may be accessible to other users on the remote host, posing a security risk.

Demonstration of the Vulnerability

• A demonstration was conducted using a local virtual machine to replicate the issue.
• The process involved using the it2 SSH command, which is an SSH wrapper for iTerm 2's SSH integrations.
• Commands executed in the terminal, including sensitive information like passwords, were logged in the temp framer.txt file.

Potential Risks

• The logging of sensitive information can lead to exposure of personally identifiable information (PII) or other confidential data.
• The vulnerability could affect shared machines used for operations and development.

Mitigation Steps

• Users are advised to upgrade to the latest version of iTerm 2 to apply the patch.
• It is recommended to remove the temp framer.txt file and rotate any exposed keys or passwords.

Development Process Insights

• The vulnerability stemmed from a misconfiguration in logging settings, where verbose logging was mistakenly left enabled in production.
• This highlights the risks associated with "print line debugging" practices in software development.

Support for Open Source Projects

• iTerm 2 is primarily maintained by a single individual, emphasizing the importance of community support for open-source projects.
• Users are encouraged to contribute to the project, whether through donations or development assistance.