Vimscript Code Injection in Vim via Netrw History File

Executive Summary

This vulnerability is a Vimscript code injection issue in the netrw plugin of Vim versions prior to 9.2.0495. It occurs in the function NetrwBookHistSave(), which saves browsed directory paths to a history file. If a directory name contains a single quote, it can break out of the single-quoted Vimscript string literal without proper escaping, allowing an attacker to inject arbitrary Vimscript code.

The injected code can include shell commands executed via functions like system() or :!, which run with the privileges of the user running Vim. To exploit this, an attacker must create a crafted directory name with a single quote and have the victim browse that directory using netrw. The malicious code executes the next time Vim is launched and the history file is sourced.

This issue was fixed in Vim version 9.2.0495 by properly quoting directory names before saving them to the history file, preventing code injection.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to arbitrary code execution with the privileges of the user running Vim. An attacker who can create a specially crafted directory name containing a single quote and trick the victim into browsing it can execute arbitrary Vimscript and shell commands on the victim's system.

The impact includes potential full command execution, which could lead to unauthorized actions such as data modification, data theft, or system compromise depending on the user's permissions.

Exploitation requires user interaction (browsing the malicious directory) and a crafted directory name, so the severity is rated medium, but the consequences of successful exploitation are severe.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking the contents of the Vim netrw history file located at ~/.vim/.netrwhist for suspicious entries. Specifically, look for directory names containing single quotes or other special characters that could break out of the Vimscript string context and inject code.

You can inspect the history file with commands like:

• cat ~/.vim/.netrwhist
• grep "'" ~/.vim/.netrwhist
• grep -E "[\'\|\;\&]" ~/.vim/.netrwhist

Additionally, verify the installed Vim version to confirm if it is prior to 9.2.0495, which is vulnerable:

• vim --version | head -n 1

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Vim to version 9.2.0495 or later, where the vulnerability has been patched.

Until the upgrade can be performed, you can manually remove or sanitize the ~/.vim/.netrwhist history file to eliminate any malicious entries that could be executed when Vim starts.

Avoid browsing directories with crafted names containing single quotes or other special characters using the netrw plugin.

Consider disabling the netrw plugin or its history feature temporarily if upgrading is not immediately possible.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows arbitrary code execution with the privileges of the user running Vim by injecting malicious Vimscript through crafted directory names. Such unauthorized code execution could lead to unauthorized access, data manipulation, or data leakage.

While the provided information does not explicitly mention compliance with standards like GDPR or HIPAA, the ability to execute arbitrary commands could potentially lead to violations of these regulations if sensitive data is accessed or compromised as a result.

Therefore, organizations using vulnerable versions of Vim with the netrw plugin could face compliance risks related to data protection and security requirements mandated by regulations such as GDPR and HIPAA.

Useful 0 Not Useful 0