Description

A shell escape vulnerability has been discovered in the restricted version of Vim (rvim). This vulnerability allows an attacker to execute arbitrary code with the privileges of the user running Vim.

Proof of Concept

The shell escape vulnerability in the restricted version of Vim (rvim) is due to the lack of input validation and sanitization of the 'shell' variable. By setting the 'shell' variable to an unintended shell and invoking 'diffpatch', an attacker can execute arbitrary code with the privileges of the user running Vim.

:redir! > ~/.vimrc | echo "!python3 -c 'import pty; pty.spawn("/bin/bash")'" | redir END | set shell=/usr/bin/vim | diffpatch

Impact

If successfully exploited, an attacker could execute arbitrary code with the privileges of the user running Vim, and escape the restricted environment. This could lead to a complete compromise of the system or network.