Arbitrary command execution on Windows

🗓️ 10 Jul 2023 00:42:29Reported by stsewdType

Arbitrary command execution on Windows by opening files from untrusted directory. Malicious file with same name as trusted executable has priority in Windows. Vulnerable plugins: perl.vim, zip.vim. Similar to CVE-2021-3013, CVE-2022-41953. Reproducible in Windows 10, GVim, Vim (Powershell, CMD). Possible fixes: absolute paths, NeedCurrentDirectoryForExePath, CreateProcessW option, prevent plugin commands from untrusted directories.

Reporter	Title	Published	Views	Family All 95
ATTACKERKB	CVE-2021-3013	11 Jun 202112:15	–	attackerkb
ATTACKERKB	CVE-2023-4736	2 Sep 202319:15	–	attackerkb
AlpineLinux	CVE-2023-4736	2 Sep 202318:02	–	alpinelinux
Apple	About the security content of macOS Sonoma 14.1	25 Oct 202300:00	–	apple
BDU FSTEC	The vulnerability of the cloning function of Git’s GUI-based version control system for Windows allows a hacker to execute arbitrary code.	8 Feb 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Vim text editor lies in the use of an insecure search path, which allows a hacker to execute arbitrary code.	15 Sep 202300:00	–	bdu_fstec
CBLMariner	CVE-2022-41953 affecting package git 2.23.4-2	14 Feb 202302:36	–	cbl_mariner
CBLMariner	CVE-2022-41953 affecting package git for versions less than 2.33.8-2	27 Sep 202318:02	–	cbl_mariner
CBLMariner	CVE-2023-4736 affecting package vim for versions less than 9.0.1897-1	27 Sep 202318:02	–	cbl_mariner
Circl	CVE-2021-3013	28 Feb 202517:01	–	circl