CVE-2007-2438

Vulnerability

Vim's sandbox mechanism had a flaw that allowed dangerous functions such as writefile, feedkeys, and system to be invoked through modelines [1][2]. This affected vim versions prior to 7.1. Modelines are lines in text files that set Vim options, and the sandbox is intended to restrict operations in untrusted content. However, the sandbox did not properly block these functions, leaving them accessible when processing modelines.

Exploitation

An attacker would need to convince a user to open a specially crafted file containing a malicious modeline that uses feedkeys() to simulate keystrokes, writefile() to write arbitrary files, or system() to execute shell commands [1][2]. The attack is user-assisted, requiring the victim to open the file in Vim. No authentication or special network position is needed beyond delivering the file.

Impact

Successful exploitation allows an attacker to execute arbitrary shell commands and write files with the privileges of the user running Vim [1][2]. This could lead to full compromise of the user's system, including data theft, malware installation, or privilege escalation if the user has elevated permissions.

Mitigation

The vulnerability was addressed in Vim 7.1, released on May 12, 2007 [4]. Users should upgrade to Vim 7.1 or later. No workaround exists other than disabling modelines (set nomodeline) or avoiding opening untrusted files. The CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.