Escape Sequence Vulnerability in Mintty Terminal Emulator by Git for Windows

CVE-2024-45301

What is CVE-2024-45301?

The Mintty terminal emulator, utilized within Cygwin and MSYS environments, has a vulnerability stemming from improper handling of escape sequences. Versions ranging from 2.3.6 to 3.7.4 are susceptible to this issue, where certain escape sequences can lead to the execution of commands that access arbitrary files. This flaw may allow an attacker to send specially crafted sequences to a terminal instance, which could be leveraged to access network paths and obtain NTLM hashes from the victim's system, potentially facilitating further attacks using password cracking tools. The vulnerability was addressed in version 3.7.5.

References