CVE-2024-48919 in cursor
Summary
by MITRE • 10/23/2024
Cursor is a code editor built for programming with AI. Prior to Sep 27, 2024, if a user generated a terminal command via Cursor's Terminal Cmd-K/Ctrl-K feature and if the user explicitly imported a malicious web page into the Terminal Cmd-K prompt, an attacker with control over the referenced web page could have a significant chance of influencing a language model to output arbitrary commands for execution in the user's terminal. This scenario would require the user explicitly opt-in to including the contents of a compromised webpage, and it would require that the attacker display prompt injection text in the the contents of the compromised webpage.
A server-side patch to not stream back newlines or control characters was released on September 27, 2024, within two hours of the issue being reported. Additionally, Cursor 0.42 includes client-side mitigations to prevent any newline or control character from being streamed into the terminal directly. It also contains a new setting, `"cursor.terminal.usePreviewBox"`, which, if set to true, streams the response into a preview box whose contents then have to be manually accepted before being inserted into the terminal. This setting is useful if you're working in a shell environment where commands can be executed without pressing enter or any control character. The patch has been applied server-side, so no additional action is needed, even on older versions of Cursor. Separately, Cursor's maintainers also recommend, as best practice, to only include trusted pieces of context in prompts.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2024
The vulnerability identified as CVE-2024-48919 affects Cursor, a code editor designed for AI-assisted programming, specifically targeting its Terminal Cmd-K/Ctrl-K feature. This flaw represents a sophisticated prompt injection attack vector that could potentially enable arbitrary command execution within user terminals. The vulnerability emerged from the interaction between Cursor's AI language model integration and its terminal command execution capabilities, creating a pathway for malicious actors to influence command output through compromised web content.
The technical exploitation of this vulnerability relies on a specific chain of user actions and attacker control over external resources. An attacker must first compromise a webpage that users might explicitly import into the Terminal Cmd-K prompt, then embed prompt injection text within that page's contents. The vulnerability stems from the lack of proper sanitization of input data flowing from web pages into the AI model's prompt processing system. This scenario aligns with CWE-74, which describes improper neutralization of special elements in data flow, and specifically relates to CWE-94, which covers improper control of generation of code. The attack requires user opt-in to include external content, making it a user-initiated privilege escalation vector rather than an automatic exploit.
The operational impact of this vulnerability extends beyond simple command injection, potentially allowing attackers to execute arbitrary shell commands with the privileges of the affected user. This represents a critical security risk in development environments where users frequently interact with terminal commands and may unknowingly import malicious content. The vulnerability's severity is amplified by the fact that it operates at the intersection of AI language model processing and terminal command execution, creating a unique attack surface that could be leveraged for privilege escalation, data exfiltration, or system compromise. The attack vector demonstrates the growing security challenges associated with AI-assisted development tools and their integration with system-level command execution features.
The remediation strategy implemented by Cursor's maintainers addresses the vulnerability through both server-side and client-side controls. The server-side patch that was deployed on September 27, 2024, specifically prevents the streaming of newlines and control characters, which are commonly used in prompt injection attacks to manipulate command execution flow. This fix directly addresses the core technical flaw by sanitizing input data before it reaches the AI processing system, aligning with ATT&CK technique T1059.001 for command and scripting interpreter and T1071.004 for application layer protocols. The client-side enhancements include the introduction of a preview box functionality that requires manual acceptance of command outputs, providing an additional layer of protection that operates as a user interface control mechanism. The implementation of the `"cursor.terminal.usePreviewBox"` setting represents a defense-in-depth approach that follows security best practices outlined in NIST SP 800-160, which emphasizes the importance of multiple security controls for critical system components.
The mitigation approach demonstrates a comprehensive response to the vulnerability, with the server-side patch ensuring backward compatibility and protection for all versions of the software. The client-side enhancements provide users with configurable security options, allowing them to adjust their security posture based on their specific operational requirements. The recommendation to only include trusted context in prompts serves as a fundamental security practice that aligns with the principle of least privilege and proper input validation. This vulnerability highlights the importance of considering AI integration security implications when designing development tools, particularly those that bridge the gap between user interface elements and system-level operations. The rapid response time of two hours from vulnerability reporting to patch deployment indicates strong security practices and incident response capabilities within the Cursor development team. The fix architecture follows established security patterns for preventing command injection and prompt injection attacks, ensuring that future similar vulnerabilities can be addressed through consistent remediation approaches that maintain system integrity while preserving functionality.