Product : Vim – Vi IMproved
Version : >= 7.2a.013; tested with 7.2b
Impact : Arbitrary code execution
Wherefrom: Local, possibly remote
Original : http://www.rdancer.org/vulnerablevim-shellescape.html
http://www.rdancer.org/vulnerablevim-latest.tar.bz2
Improper implementation of the shellescape() function and lack of
documentation can result in untrusted data being insufficiently
sanitized, possibly leading to arbitrary code execution.
The shellescape() function, added by patch 7.0.111, has since been
modified in 7.2a.013 to escape special characters, so as to be useful
when sanitizing arguments of the ``execute'' command:
``shellescape({string} [, {special}])
Escape {string} for use as shell command argument.
[…]
When the {special} argument is present and it's a non-zero Number or
a non-empty String […], then special items such as "%", "#" and
"<cword>" will be preceded by a backslash. This backslash will be
removed again by the :! command. Example of use with a :! command:
:exe '!dir ' . shellescape(expand('<cfile>'), 1)
This results in a directory listing for the file under the cursor.''
-- Vim Reference Manual (``eval.txt'')
shellescape() does not escape all special items. In particular,
shellescape() does not escape the ``!'' character.
The Vim documentation lacks a comprehensive explicit list of special
items. This might have been the reason why patch 7.2a.013 failed to
acknowledge ``!'' as a special item.
We have added a test case to our test suite; run ``make test'' in the
``shellescape'' directory. The result will show as ``VULNERABLE'' if
the shellescape() function of the version of Vim tested doesn't escape
the ``!'' special item, ``FAILED'' otherwise.
To show that this vulnerability can be exploited, we have updated our
``tar.vim'' exploit. Run ``make test'' in the ``tarplugin.v2''
directory. Please note that the problem lays within the shellescape()
function implementation, rather than within ``tar.vim''.
tarplugin.v2: VULNERABLE
shellescape: VULNERABLE
(Tests for vulnerabilities that are part of the accompanying test suite
but are not mentioned in this advisory are omitted from this table.)
This advisory is Copyright 2008 Jan Minar <[email protected]>
Copying welcome, under the Creative Commons ``Attribution-Share Alike''
License http://creativecommons.org/licenses/by-sa/2.0/uk/
Code included herein, and accompanying this advisory, may be copied
according to the GNU General Public License version 2, or the Vim
license. See the subdirectory ``licenses''.
Various portions of the accompanying code were written by various
parties. Those parties may hold copyright, and those portions may be
copied according to the respective licenses.
2008-07-16 Sent to: <[email protected]> – This is the correct address, not
<[email protected]>
2008-07-16 Sent to: <[email protected]>, <[email protected]>,
<[email protected]>, <[email protected]>