HomeTech infoAttack the network

Your Linux system can be hacked just by opening a file in Vim or Neovim Editor

Linux users, be careful!

If you haven't updated your Linux operating system recently, especially the command line text editor, don't even try to access the contents of the file via Vim or Neovim, pay attention, your system is complete All can be hacked.

Well-known security researcher Armin Razmjou recently discovered a serious vulnerability related to executing arbitrary operating system commands (CVE-2019-12735) in Vim and Neovim - 2 line text editing applications The most common and powerful commands are usually preinstalled on most Linux-based operating systems.

Your Linux system can be hacked just by opening a file in Vim or Neovim Editor Picture 1

  1. The Russian army will completely replace Windows with Astra Linux

On Linux systems, the Vim editor allows users to create, view or edit any file, including text, programming scripts and documents.

Because Neovim is just an extended version of Vim (with better user experience, plugins and GUI), of course the above serious code execution vulnerability will also appear in this application.

Vulnerabilities execute code in Vim and Neovim

Security expert Armin Razmjou has discovered a flaw in the way Vim editor handles "modelines" - the feature is turned on by default to automatically find and apply a set of customized options. Accessed by the file creator, close to the start and end lines in the document.

Your Linux system can be hacked just by opening a file in Vim or Neovim Editor Picture 2

  1. The Korean government is going to use the Linux operating system instead of Windows because of the expensive cost

Although the editor only allows applying a subset of options in the model (for security reasons) and using sandbox protection if it contains unsafe expressions, Armin Razmjou reveals that use the ": source!" (with an amendment [!]) can overcome sandbox protection.

Therefore, users who only need to open a specially crafted file using Vim or Neovim can also allow an attacker to secretly execute commands on their Linux system, as well as control the system. Remote system.

The security researcher has also released 2 Proof of Concept (PoC) on how to exploit the vulnerability mentioned above. One of these represents a real-life attack scenario when a remote attacker has access to the reverse shell from the victim's system as soon as he opens it.

Your Linux system can be hacked just by opening a file in Vim or Neovim Editor Picture 3

  1. Hacker successfully stole 100,000 photos from border control database

Developers responsible for maintenance of Vim (patch version 8.1.1365) and Neovim (released in v0.3.6) have also released updates for both of these utilities to solve the problem. Also recommend that users install the new version as soon as possible.

Besides, researcher Armin Razmjou has also provided some additional recommendations for users as follows:

  1. Disable modelines feature
  2. disable "modelineexpr" to not allow expressions to appear in modelines.
  3. Switch to using the "securemodelines plugin" as a safe alternative to Vim models.
4 ★ | 3 Vote
linuxVimhacklinux hacksecurity holeremote code execution

You should read it

May be interested

  • 5 best Vim-inspired editors for Linux5 best Vim-inspired editors for Linux
    if you are looking for a vim-like editor, modern and lightweight yet powerful, here is a list of the best vim-inspired editors that are more user-friendly.
  • 5 best LaTex editors for Linux5 best LaTex editors for Linux
    the word editor is great, but too simple. this tool is great for writing letters or essays, but complex documents are not.
  • 5 best Markdown editors for Linux5 best Markdown editors for Linux
    previously, tipsmake.com has introduced 6 best free online markdown editors and converters and now the best markdown editors for linux.
  • Which file system should be used for removable storage devicesWhich file system should be used for removable storage devices
    in the tutorial article below, we will learn about some concepts related to file system - file system for use with portable storage devices. in essence, file systems are extremely important components in an operating system, assigned by the user account ...
  • How to use cURL command in LinuxHow to use cURL command in Linux
    no matter what you use your computer for, at least once you need to download a file and opening the browser may seem overkill. this will be the time curl really plays its role.
  • Should use the Ext4 or Btrfs file system?Should use the Ext4 or Btrfs file system?
    linux has many different file system options. the current default option is ext4. users are always motivated to change the default file system to btrfs. but is btrfs better than ext4? find the answer through the following article!
  • What file is AAC? How to open, edit and convert AAC filesWhat file is AAC? How to open, edit and convert AAC files
    a file that is somewhat expansive .aac is the mpeg-2 advanced audio encoding file (mpeg-2 advanced audio coding file).
  • What is Sed? Learn about the Sed command in LinuxWhat is Sed? Learn about the Sed command in Linux
    sed is a line editor, commonly used to change text in files on the linux operating system.
  • How to create a hidden file system in Linux using ShufflecakeHow to create a hidden file system in Linux using Shufflecake
    shufflecake is a simple but very powerful file system encryption utility for linux. unlike traditional drive encryption schemes, shufflecake works by not only encrypting data within the file system but also hiding that data from the system itself.
  • Link Download Free PDF Editor 1.3Link Download Free PDF Editor 1.3
    free pdf editor is a free pdf creator with a really misleading name. although the program name means editing pdf files, the software can actually only create a new file - it won't let you edit pdfs from other sources.

Attack the network