-
Notifications
You must be signed in to change notification settings - Fork 1.1k
Potential XXE #2274
Comments
Syntastic doesn't do any network operation itself. It also doesn't care about the contents of your files. What syntastic does is run third-party linters against your files, parses their output, and shows you the results in a window. That's all it does. If the linter involved in your test is To see the exact command lines constructed by syntastic you can set Syntastic is not secure. It was never meant to be secure. Several security problems have been found in it, and I'm sure there are many more yet to be discovered. Most of the time the "solution" to these was to tell people they're running checkers X, Y, Z on their own risk. So please use your common sense: syntastic is a damned Vim script. It can't protect itself from normal operation, let alone protect you against malicious third-party code. shrug |
Ok, I'll check for the debug symbols as soon as I have some time. |
Since you rise this point, here's a short categorization of the kind of security problems syntastic has had so far:
If you find an actual vulnerability I'll try to patch it. Or perhaps add a note about it. Patches are still welcome. 😄 |
I just ran into this same (surprising) issue. What about passing (at least) |
@Matir That would also prevent |
Then complain to |
@machinexa2 You can disable XML/XSLT parsing by customizing parsers for syntastic in your
Though I disagree with @lcd047 about what the default should be, I respect the choice and acknowledge that it's a tradeoff between security and usability. Keep in mind that opening a potentially malicious file with vim probably has lots of risk outside of syntastic as well. Look at the history of modelines. |
Hello,
yesterday I was pentesting a website and I was happy to see some XXE popping out in my Burp.
Then I realized that the requests weren't coming from the website but from my own machine!
So I investigated and found out that syntastic was making the requests while parsing my XML containing the XXE.
Here's one of the payloads I tested:
And here's the results on Burp:
![Syntastic_Burp_HTTP](https://user-images.githubusercontent.com/52079194/61118460-10c7ec80-a499-11e9-8afb-8142d4bd69ce.png)
The requests are made each time syntastic parses the file, so also at the very moment you open it !
I found that the vulnerable part is in the file
syntastic/syntax_checkers/xml/xmllint.vim
but I didn't yet get the logic and why it's making the requests (maybe it's a feature !), so I decided to make an issue to discuss if it's necessary to patch or it's a normal behavior.I am not yet able to exfiltrate data but I'm working on it, and maybe there's other security ninjas with fancy tricks capable of doing it.
Other useful information:
The text was updated successfully, but these errors were encountered: