Executive Summary

This vulnerability exists in the Zed code editor versions prior to 0.227.1. Zed builds SSH/WSL remote commands as a shell command string starting with 'exec env ...', but it inserts environment variable keys without any shell quoting or validation.

If an attacker can control an environment variable key, for example through project terminal settings, shell expansions within the key (such as $(...)) are executed by the remote shell when a terminal is opened.

This behavior allows an attacker to execute arbitrary commands on the remote host under the victim user's account.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to arbitrary command execution on the remote host with the privileges of the victim user.

This means an attacker could run malicious commands remotely, potentially leading to data theft, system compromise, or further attacks within the affected environment.

Because the attacker can execute commands remotely, the integrity, confidentiality, and availability of the affected system and its data can be severely impacted.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update Zed to version 0.227.1 or later, where the issue is fixed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an attacker to execute arbitrary commands on a remote host under the victim user's account, potentially leading to unauthorized data access, modification, or exfiltration.

Such unauthorized access and potential data breaches could impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of sensitive data and prevention of unauthorized access.

However, the provided information does not explicitly discuss compliance implications or specific regulatory impacts.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if your Zed editor version is prior to 0.227.1 and if any project terminal settings contain environment variable keys with shell expansions or suspicious characters.

Specifically, inspect the `.zed/settings.json` file in your project directories for environment variable keys that include shell command substitutions such as $(...) or other special shell characters.

You can use commands like the following to search for suspicious environment variable keys in your project settings:

• grep -r --include=settings.json '".*\$\(.*\).*"' .
• grep -r --include=settings.json '".*;.*"' .

Additionally, verify your Zed version by running the command to check the installed version and ensure it is 0.227.1 or later.

Useful 0 Not Useful 0