oss-sec mailing list archives

potential code execution with tar.vim and special crafted tar files
===================================================================
Date: 02.03.2025
Severity: High
CVE: <not-yet-assigned>
CWE: Improper Input Validation (CWE-20)

Vim is distributed with the tar.vim plugin, that allows easy editing and
viewing of (compressed or uncompressed) tar files.

Since commit 129a8446d23cd9cb4445fcfea259cba5e0487d29
(Nov 11, 2024 runtime(tar): Update tar.vim to support permissions), the
tar.vim plugin uses the ":read <fname>" ex command line to append 
<fname> below the cursor position, however the <fname> is not sanitized 
and is taken literaly from the tar archive. This allows to execute shell
commands via special crafted tar archives. Whether this really happens,
depends on the shell being used ('shell' option, which is set using
$SHELL).

Impact is **high** but a user must be convinced to edit such a file 
using Vim which will reveal the filename, so a careful user may suspect 
some strange things going on.

The Vim project would like to thank RyotaK (GMO Flatt Security Inc) for
reporting this issue.

The issue has been fixed as of Vim patch v9.1.1164

[Commit](https://github.com/vim/vim/commit/334a13bff78aa0ad206bc436885f63e3a0bab399)
[Github Advisory](https://github.com/vim/vim/security/advisories/GHSA-wfmf-8626-q3r3)

Thanks,
Christian
-- 
Pecor's Health-Food Principle:
        Never eat rutabaga on any day of the week that has a "y" in it.

Current thread:

• [vim-security] potential code execution with tar.vim and special crafted tar files Christian Brabandt (Mar 02)