Doesn’t matter if you’re a developer, designer or a writer, a good text editor always help you save time and make you work in a more efficient way. For example, the use of Sublime while programming because it includes some useful tools like ‘syntax highlighting’ and ‘auto-complete’ that every advanced text editor should have.
The advanced text editors also offer users extensibility, allowing users to install and run third-party plugins to extend the editor’s functionality and most importantly its scope, information security training analysts explain. However, it’s a known fact that third-party plugins always pose a significant risk of hacking, whether it’s about WordPress plugins or Windows’ extensions for Chrome, Firefox or Photoshop.
SafeBreach information security training researcher Dor Azouri analyzed several popular extensible text editors for Unix and Linux systems, including Sublime, Vim, Emacs, Gedit, and pico/nano, and found that except for pico/nano, all of them are vulnerable to a critical privilege escalation flaw that could be exploited by attackers to run malicious code on a victims’ machines.
“This method succeeds regardless of the file being opened in the editor, so even limitations commonly applied on sudo commands might not protect from it,” the paper reads.
“Technical users will occasionally need to edit root-owned files, and for that purpose they will open their editor with elevated privileges, using ‘sudo.’ There are many valid reasons to elevate the privileges of an editor.”
The issue resides in the way these text editors load plugins. According to the information security researcher, there’s inadequate separation of regular and elevated modes when loading plugins for these editors.
Their folder permissions integrity is not maintained correctly, which opens the door for attackers with regular user permissions to elevate their privileges and execute arbitrary code on the user’s machine.
A malvertising campaign could allow attackers spread malicious extension for vulnerable text editors, enabling them to run malicious code with elevated privileges, install malware and remotely take full control of targeted computers.
Azouri suggests Unix users can use an open-source host-based intrusion detection system, called OSSEC, to actively monitoring system activity, files integrity, logs, and processes.
Users should avoid loading 3rd-party plugins when the editor is elevated and also deny write permissions for non-elevated users.
The information security training expert advised developers of text editors to change the folders and file permission models to complete the separation between regular and elevated modes and if possible, provide a manual interface for users to approve the elevated loading of plugins.
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
