UTM: Unsafe URL Handling

### Summary The VM manager acts as a frontend to qemu and the Apple Virtualization Framework. ### Severity Low - Could result in a file download or VM management without sufficient user consent. ### Proof of Concept The UTM URI handling [scheme](https://docs.getutm.app/advanced/remote-control/) does not ask for confirmation before performing any actions, including downloading or starting a VM. Starting VMs is done using the name only, which an attacker can control if they cause a victim to download a VM image provided by the attacker. For example, the URI `utm://downloadVM?url=https%3A%2F%2Fexample.com%2FVM.zip` would cause UTM to download and unpack a ZIP file located at `https://example.com/VM.zip` into its VM storage directory, assuming it had the correct file structure for a UTM VM. This download happens without confirmation from the UTM application, regardless of the URI. An example legitimate use of this command can be found at the UTM [template gallery](https://mac.getutm.app/gallery/), where each entry has a link using this scheme to trigger a download of the VM template. When loaded in modern versions of Chrome, the browser itself will trigger a warning asking permission to send the URI to UTM, but the warning is generic and does not sufficiently allow the user to understand what will happen if they allow it. VMs can also be started through this URI scheme. For example, the URI `utm://start?name=example` would start a VM named `example`. This again has no user confirmation from UTM itself, and would rely on the browser to adequately warn the user before triggering the start action. 1. Install UTM (`brew install --cask utm@4.4.5`). 2. Paste the following URL into Chrome: `utm://downloadVM?url=https://github.com/utmapp/vm-downloads/releases/download/archlinux-arm64/archlinux-arm64-utm4.zip`. 3. Chrome will ask for permission to open UTM, but UTM itself will not ask for confirmation before downloading the VM. 4. Once the VM is downloaded, paste the following URL into Chrome: `utm://start?name=ArchLinux` 5. Chrome will ask for permission to open UTM, but UTM itself will not ask for confirmation before starting the VM. 6. The VM will start. This PoC uses safe VMs provided by the UTM developers, but there is no restriction on the source or contents of the VM that will be downloaded and started. ### Further Analysis Desired behavior should include: 1. Require confirmation from the user that a given download should start. Allowlisting of specific URI prefixes (such as the UTM Github project) may be acceptable, but care should be taken to avoid allowing too broadly: for example, allowing `https://github.com/utmapp/vm-downloads/*` would allow an attacker to fork the repo and use an attack similar to [impostor commits](https://www.chainguard.dev/unchained/what-the-fork-imposter-commits-in-github-actions-and-ci-cd) to bypass the check. Restricting the allowlist to `https://github.com/utmapp/vm-downloads/releases/download/*` would likely be safe. 2. Require confirmation for other control actions such as VM start. Allowing the user to allowlist direct control of specific VMs may be acceptable, but in practice users should be encouraged to use `utmctl` instead, which does not have the same security implications (as any attacker that can interact with it could presumably already run arbitrary shell commands). ### Timeline **Date reported**: 01/05/2024 **Date fixed**: Fixed in version [4.5.1](https://github.com/utmapp/UTM/releases/tag/v4.5.1) **Date disclosed**: 04/05/2024

Severity from

GitHub (reviewed advisory)

• github.com/google/security-research/security/advisories/GHSA-q2pr-jhj2-j8vx
• github.com/google/security-research