When a terminal is rolled out, it immediately spawns a shell process and connects it directly to the user's keyboard. From there, the attacker can issue arbitrary commands with the full privileges of the logged-in user.
Researchers have confirmed that the shell will execute any command typed into it, including commands that delete files, install software, and modify system configuration. In some cases, the shell has been observed executing commands the user typed themselves.
We are releasing a working proof of concept below. The page you are reading now has a shell in it.
Close the tab if you are concerned. Exploitation requires local access, a working keyboard, and the ability to locate the Terminal application. Threat intelligence indicates all three are widely available to attackers.
