You have to select exactly the right text, and that text will never look like "select this right now" --- if you've seen the characters we're talking about, it's like Zalgo text. Selection in an xterm is not the ordinary response to these strings.

This is a little like Clickjacking, where you'd expect a bounty hunter to come at you with "this very severe bug can be triggered simply by clicking", and you respond "well, we should fix that, but users never click in those places, so we're going to send you a t-shirt" and the bounty hunter responds "no, clicking is a fundamental user interaction, you should send me $5000".

And my point isn't even that this is a dumb bug (certainly, it's not as dumb as CJ usually is). It's that there is absolutely no fucking way it is a 9.6 on a 10.0 scale of severity. Shellshock, ffs, has the same NVD CVSS as this bug. Shellshock doesn't even care what terminal you're using.

>if you've seen the characters we're talking about, it's like Zalgo text. Selection in an xterm is not the ordinary response to these strings.

Yeah, with all due respect, you're not in touch with what ordinary responses are.

When people see zalgo like the infamous SO regex post, selecting it is the first thing they do.

That's what the bug bounty person says about their CJ bug. Meanwhile: NVD has given this the same score as Shellshock, which is dispositive of how bad CVSS is.

In fact, it is dispositive about exactly the opposite. But let's agree to disagree.

Shellshock was a universal RCE in anything that ran bash with control over environment variables --- which included a huge subset of all web services, often on any code path in which bash was just incidentally run. Not only that, but the vulnerability was exploited in bash; it wasn't memory corruption, there were no system-specific offsets to limit the scope of exploits, nor could you have preemptively hardened a system against it with ASLR or W^X.

NVD gives Shellshock the same CVSS as this vulnerability, which requires a user in xterm to see a bunch of international UTF-8 characters and select them precisely enough to make a memory corruption exploit encoded in those characters run --- and do that without any feedback from the target, because what you're interacting with here is xterm, not a network service you can talk directly to, or a Javascript runtime.

I do not agree to disagree. The CVSS here is simply wrong.