Uncontrolled Search Path Element Affecting vim/vim package, versions [,9.1.1947)

Affected versions of this package are vulnerable to Uncontrolled Search Path Element when using cmd.exe as a shell for resolving external commands while using tools like grep with :! or compiler :make commands. An attacker can execute arbitrary code by placing a malicious executable in the same directory as the file being edited, which is then inadvertently run when certain commands or tools are invoked.

Note:

This issue affects only Windows OS.

1. Create a folder, folder1. Put some text files in this folder.
2. Copy C:\Windows\System32\calc.exe and place it in folder1, changing its name to findstr.exe. (Instead of calc.exe you could use any other executable that produces a noticable effect. In a real-world attack, the attacker would plant an executable that seems outwardly to behave like findstr but surreptitiously performs malicious actions.)
3. Open a text file in folder1 using either Vim or gVim.
4. Execute an (external) grep command in Vim, for example: :grep "a" *.txt
5. After a few moments you will see the Windows calculator pop up, demonstrating that the attacker has gotten the ability to run an arbitrary executable that they planted in the folder.

• GitHub Commit