I teksteditorer Vim og Neovim blev fundet en sårbarhed (CVE-2019-12.735), som gør det muligt at udføre vilkårlig kode, mens du åbner et specielt designet fil.
The problem manifests itself with the activity of the modeline enabled by default (“: Mønstret sæt“), som gør det muligt at definere redigeringsmuligheder i filen, der behandles. Vulnerability eliminated in Vim 8.1.1365 og Neovim 0.3.6 udgivelser.gennem modeline, allowed only a limited number of options. If expression is specified as an option value, it is executed in the sandbox mode, which allows using only the simplest safe operations.
På samme tid, Det “: Kilde” command is and in it can be used “!” Modifier to run arbitrary commands from specified file. Dermed, to execute the code, it is sufficient to indicate in the modeline line a construction of the form “set foldexpr = execute (‘\: Kilde! Some_file’):“. In Neovim, execute call is forbidden, Men assert_fails can be used instead.
For eksempel, to execute “uname -a” kommando, simply open a file in Vim or Neovim, the first or last line of which says:
:!uname -a||" vi:fen:fdm=expr:fde=assert_fails("source\!\ \%"):fdl=0:fdt="
Det “Kilde!%” comand will read commands from the current file and, derfor, execute “:! Uname -a“. To hide this line from output by the cat utility, can be used escape sequences.
For eksempel, I this prototype of an exploit during operation of a file in vim, created network connection with shell access to victim’s system, but this file will not cause suspicion when outputting to the terminal with the cat utility.
You can check the modeline activity using the “: Mønstret sæt?” kommando. To disable vimrc, you can add the line “set nomodeline“. In distributions, the problem is fixed in RHEL, SUSE/openSUSE, Fedora, FreeBSD, Ubuntu, Arch Linux og Alt. Vulnerability remains uncorrected in Debian.
Kilde: https://nvd.nist.gov
