Arduino App Lab Terminal Component Input Validation Vulnerability Allowing Arbitrary Code Execution

A vulnerability exists in the Terminal component of Arduino App Lab versions prior to 0.4.0. The issue arises from inadequate sanitization and validation of input data from connected hardware devices, particularly in the Serial and Address metadata fields. This flaw occurs during the handling of device information when establishing a terminal session. An attacker with physical access to a compromised board can inject payloads containing shell metacharacters, which are then executed on the host system with the user's privileges. This vulnerability has been addressed in version 0.4.0.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the host system, executed with the privileges of the user running Arduino App Lab.

Remediation

Users can upgrade to Arduino App Lab version 0.4.0 or later to address this vulnerability.