Impact

It was found that Tabby's terminal linkifier passes any detected URI directly to the operating system's protocol handler without validating the protocol scheme. This allows a malicious SSH or Telnet server to send crafted terminal output containing dangerous protocol URIs which Tabby renders as clickable links, triggering arbitrary OS protocol handlers on the victim's machine.

The vulnerability exists in the current release of:

tabby-linkifier

The vulnerability is triggered when a user connects to a malicious SSH/Telnet server that sends terminal output containing a crafted URI such as vscode://, ms-msdt://, or zoommtg://. Tabby linkifies the URI and clicking it invokes the corresponding OS protocol handler with no validation or warning from Tabby. On unpatched Windows systems this can lead to RCE via known protocol handler exploits such as follina (CVE-2022-30190).

Patches

The vulnerability exists in tabby-linkifier/src/handlers.ts. The fix is to whitelist safe protocols before calling openExternal():

const SAFE_PROTOCOLS = ['https:', 'http:', 'ftp:', 'mailto:']
const url = new URL(uri)
if (SAFE_PROTOCOLS.includes(url.protocol)) {
    this.platform.openExternal(uri)
}

All users are recommended to avoid clicking application protocol links they do not understand and trust in SSH/Telnet sessions.

References

• tabby-linkifier/src/handlers.ts --> URLHandler.handle()
• tabby-core/src/directives/fastHtmlBind.directive.ts --> unsanitized innerHTML
• https://nvd.nist.gov/vuln/detail/CVE-2022-30190