This is grim, Vim and Neovim: Opening this crafty file in your editor may pwn your box. Patch now if not already

Welcome to Vim Sh*tty 2000

Proof-of-concept text files are now available that, when opened in a vulnerable installation of the Vim and Neovim, will execute commands on the underlying machine, or even open a backdoor.

Bug-hunter Armin Razmjou this week documented a security hole, designated CVE-2019-12735, in the popular text and source code editors that can be potentially exploited by malicious documents to commandeer victims' computers when opened. The vulnerability is present in Vim versions prior to 8.1.1365, and Neovim builds before 0.3.6.

Razmjou reported the issue to the maintainers of both applications on May 22. Vim had a patch out by May 23, and Neovim released its fix on May 29. Now that Razmjou's exploit code is available, you should ensure you're patched: updating either application to the most recent build will address the flaw. Razmjou also noted that some Linux distributions, such as Debian, ship with Vim configuration files that block the hole by default – more on that below.

Invader Vim

The infosec bod said the vulnerability lies in code that handles modeline instructions that Vim uses to set things like the text width or spacing in a file. These settings are usually specified within a given text file to format it as needed, however, it turns out these modelines can be abused to execute system commands on the underlying host as the user.

"The modeline feature allows to specify custom editor options near the start or end of a file," Razmjou explained. "This feature is enabled by default and applies to all file types, including plain .txt."

Normally, the modeline settings are limited to a small group of functions, and any system command to be executed is isolated in a sandbox to keep it from harming or accessing the rest of the computer.

That sandbox, however, can be turned off by putting a modifier (in this case !) at the end of a source instruction. This instruction reads in a specific file from the file system, or the file being edited if % is used. Combining ! and % makes Vim execute commands within the edited text file outside the sandbox.

Ramzjou's proof-of-concept text file demonstrates how this can be exploited to open a backdoor, known as a reverse shell, allowing miscreants to inject system commands over the network or internet, and cover its tracks after.

In another example, see below, the text runs the command uname -a on the underlying box to get details of the operating system kernel.

:!uname -a||" vi:fen:fdm=expr:fde=assert_fails("source\!\ \%"):fdl=0:fdt="

Save that as poc.txt and then run vim poc.txt as normal to trigger the flaw.

In addition to updating Vim and Neovim to the latest versions, there are other protections you can put in place to avoid attack. Your .vimrc configuration file in your home directory can be modified to disable modelines (include set nomodeline), or you can disable expressions in modelines (modelineexpr) completely.

With Debian and some other Linux distros, .vimrc ships with modelines already disabled by default, hence those versions are not vulnerable out of the box, though it is still a good idea to update your copy of Vim or Neovim to the latest version. ®

Similar topics

Other stories you might like

  • The future: Windows streaming through notched Apple screens

    Choice is the word for Jamf's Dean Hager

    Interview As Apple's devices continue to find favour with enterprise users, the fortress that is Windows appears to be under attack in the corporate world.

    Speaking to The Register as the Jamf Nation User Conference wound down, the software firm's CEO, Dean Hager, is - unsurprisingly - ebullient when it comes to the prospects for Apple gear in the world of suits.

    Jamf specialises in device management and authentication, and has long been associated with managing Apple hardware in business and education environments. In recent years it has begun connecting its products with services such as Microsoft's Azure Active Directory as administrators face up to a hybrid working future.

    Continue reading
  • There’s a wave of ransomware coming down the pipeline. What can you do about it?

    AI can help. Here’s how…

    Sponsored The Colonial Pipeline attack earlier this year showed just how devastating a ransomware attack is when it is targeted at critical infrastructure.

    It also illustrated how traditional security techniques are increasingly struggling to keep pace with determined cyber attackers, whether their aim is exfiltrating data, extorting organisations, or simply causing chaos. Or, indeed an unpleasant combination of all three.

    So, what are your options? More people looking for more flaws isn’t going to be enough – there simply aren’t enough skilled people, there are too many bugs, and there are way too many attackers. So, it’s clear that smart cyber defenders need to be supplemented by even smarter technology incorporating AI. You can learn what this looks like by checking out this upcoming Regcast, “Securing Critical Infrastructure from Cyber-attack” on October 28 at 5pm.

    Continue reading
  • Ransomware criminals have feelings too: BlackMatter abuse caused crims to shut down negotiation portal

    Or so says infsec outfit Emsisoft

    Hurling online abuse at ransomware gangs may have contributed to a hardline policy of dumping victims' data online, according to counter-ransomware company Emsisoft.

    Earlier this month, the Conti ransomware gang declared it would publish victims' data and break off ransom negotiations if anyone other than "respected journalist and researcher personalities" [sic] dared publish snippets of ransomware negotiations, amid a general hardening of attitudes among ransomware gangs.

    Typically these conversation snippets make it into the public domain because curious people log into ransomware negotiation portals hosted by the criminals. The BlackMatter (aka DarkSide) gang's portal credentials (detailed in a ransom note) became exposed to the wider world, however, and the resulting wave of furious abuse hurled at the crims prompted them to pull up the virtual drawbridge.

    Continue reading

Biting the hand that feeds IT © 1998–2021