Vim C Omni-Completion Command Injection

Executive Summary

This vulnerability exists in Vim, an open source command line text editor, specifically in versions prior to 9.2.0735. The issue is in the C omni-completion script, which interpolates certain fields from a tags entry into a :vimgrep pattern without escaping them properly. Because :vimgrep treats the bar character as a command separator, a maliciously crafted tag field can close the search pattern and append an arbitrary Ex command. When a hostile .c file containing such a tag entry is opened and C omni-completion is invoked, the appended command runs with the privileges of the editing user.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an attacker to execute arbitrary commands on the system with the privileges of the user running Vim. This can lead to unauthorized actions such as modifying files, executing malicious code, or compromising the system's security.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update Vim to version 9.2.0735 or later, where the issue has been fixed.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if your Vim installation is a version prior to 9.2.0735, as the issue is fixed starting from that version.

To detect potential exploitation attempts, monitor for usage of the C omni-completion feature (typically invoked with CTRL-X CTRL-O) in Vim when editing C source files, especially if filetype plugins are enabled and a tags file is present.

You can verify your Vim version by running the following command in your terminal:

• vim --version

To check if the vulnerable script is present, you can look for the ccomplete.vim file in the runtime autoload directory:

• ls $(vim --cmd 'echo $VIMRUNTIME' --cmd 'quit')/autoload/ccomplete.vim

Since the vulnerability involves crafted tags files, you can inspect your tags files for suspicious entries containing typeref: or typename: fields with unusual characters such as the pipe (|) symbol that could be used to inject commands.

There are no specific built-in commands to detect exploitation attempts automatically, but monitoring Vim usage logs or audit logs for unexpected command executions triggered during omni-completion could help.

Useful 0 Not Useful 0