Escape from AppleScript: Even folder names can be user input
Blog post from Sonar
OpenInTerminal, a macOS utility, was found to have an AppleScript Injection vulnerability that allows arbitrary code execution through a flaw in how special characters within folder paths are escaped, specifically when using AppleScript to open directories in terminal applications. This vulnerability is triggered when a user opens a malicious folder using OpenInTerminal, with the attack leveraging symbolic links and nested folder structures to minimize user interaction. The core issue arises from insufficient escaping of special characters for the AppleScript context, potentially allowing attackers to inject their own commands. The OpenInTerminal maintainer addressed this flaw by replacing string-built shell commands with structured argument passing, ensuring the integrity of argument boundaries and eliminating the risk of injection. This incident underscores the importance of using native APIs for process execution to avoid mismatches in escaping and sanitization rules, which can lead to critical vulnerabilities.
No tracked trend matches for this post yet.
Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.