Impact Analysis

This vulnerability can allow an attacker to execute arbitrary Vimscript commands, including shell commands, with the privileges of the user running Vim.

An attacker must first place a specially crafted file with a malicious filename containing a pipe character in a directory browsed by the victim using the netrw plugin.

If the victim deletes this malicious file using the netrw browser, the attacker’s code can be executed, potentially leading to unauthorized command execution on the victim’s system.

The severity is rated Medium because exploitation requires user interaction and a deliberately planted file, but the impact can be significant due to full command execution capabilities.

Useful 0 Not Useful 0

Executive Summary

This vulnerability is a Vimscript code injection issue in the netrw plugin of Vim versions prior to 9.2.0663. It occurs in the function s:NetrwLocalRmFile() when deleting a local file from the netrw browser.

The problem arises because the filename derived from the directory listing is only partially escaped (only backslashes are escaped) before being passed to the :execute command. If a filename contains a pipe character (|), it can terminate the intended command and inject arbitrary Vimscript commands, including shell commands via :call system() or :!.

Exploitation requires a crafted malicious filename containing a pipe character to be present in the browsed directory and the victim to delete that file using the netrw plugin.

This vulnerability was fixed in Vim patch version 9.2.0663 by properly escaping filenames using the fnameescape() function before passing them to :execute, preventing command injection.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability arises when a maliciously crafted filename containing a pipe character (|) is present in a directory browsed by Vim's netrw plugin and the user deletes that file using the netrw browser. Detection involves identifying such crafted filenames on your system.

• Search for filenames containing the pipe character (|) in directories that users might browse with Vim's netrw plugin.
• Use commands like `find /path/to/scan -name '*|*'` on Unix-like systems to locate files with pipe characters in their names.
• Check the Vim version installed by running `vim --version` to verify if it is prior to 9.2.0663, which is vulnerable.

Since exploitation requires user interaction (deleting the crafted file via netrw), monitoring user actions in Vim or auditing file deletions in directories with suspicious filenames may also help detect attempts.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade Vim to version 9.2.0663 or later, where the vulnerability is fixed by properly escaping filenames before executing commands.

• Update Vim to version 9.2.0663 or newer.
• Avoid browsing or deleting files with suspicious or unusual filenames containing special characters like the pipe (|) in Vim's netrw plugin.
• Educate users about the risk of deleting files with crafted names in Vim's netrw browser.

If immediate upgrade is not possible, restrict user permissions to prevent creation of files with special characters in directories accessed by Vim, and monitor for suspicious filenames.

Useful 0 Not Useful 0