Authentication bypass using an alternate path or channel in kitty - #VU164397

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary commands as the user running kitty.

The vulnerability exists due to an authentication bypass in kitty's is_cmd_allowed() when password-protected remote control mistakes requests containing cancel_async and non-empty async_id for cancellations before checking passwords or action allow-lists. A remote attacker can send a remote-control request containing "cancel_async": true and "async_id": "x", but no async field, through terminal output or an accessible remote-control socket to execute commands.

Affected software

Remediation

External References

• https://github.com/kovidgoyal/kitty/security/advisories/GHSA-wpff-qjx2-fw8r

Related Security Bulletins

• Authentication bypass using an alternate path or channel in kitty