On Di, 31 Okt 2017, Hanno Böck wrote:
> Hi,
>
> I wanted to point out an issue here with vim swap files that make them
> a security problem.
>
> By default vim creates a file with the name .filename.swp in the same
> directory while editing. They contain the full content of the edited
> file. This usually gets deleted upon exit, but not if vim crashes or
> gets killed (e.g. due to a reboot).
>
> On web servers this can be a severe security risk. One can e.g. scan
> for web hosts that have swap files of PHP configuration files and thus
> expose settings like database passwords. (e.g. wget
> http://example.com/.wp-config.php.swp )
>
> In a scan of the alexa top 1 million I found ~750 instances of such
> files. I tried to inform affected people as best as I could. I also
> discovered such scans in my own web server logs, so I assume black hats
> are already aware of this and it's actively exploitet.
>
> I was wondering how to best avoid this on my own servers and I first
> thought about saving the swap files to tmp ( with "set directory").
> However on multiuser systems this creates another security problem.
> These files are world readable, thus instead of leaking information to
> the world it's now leaking information to other users on the same
> system. Thus even if one is aware of the issue it's nontrivial to get
> secure settings (I've now worked around this by having per-user tmp
> dirs with secure permissions.)
>
> I think vim should change the behavior of swap files:
> 1. they should be stored in /tmp by default
> 2. they should have secure permissions (tmp file security is
> a tricky thing and needs careful consideration to avoid symlink attacks
> and the like, but there are dedicated functions for this like mkstemp).
> 3. Ideally they also shouldn't leak currently edited filenames (e.g.
> they shouldn't be called /tmp/.test.txt.swp, but more something
> like /tmp/.vim_swap.123782173)
It is true, that this can cause a problem. However, I am not sure its
correct to blame vim here.
First, I think you need to configure your webserver to be able to view
dotfiles. I believe a default installation of at least apache won't let
you show dotfiles. Second, I wonder why those swapfiles are not deleted.
Somehow Vim must have crashed or be killed and in that case one
certainly don't want that the swapfiles are deleted (think of recovery).
Finally, using git for managing your document root, can show you those
rubbish swap files, since the directory is not clean than, if you really
need to edit your files on the server directly and do not use a
deployment of some kind.
One could argue, that swap files should be stored below ~/.vim directory
tree. But what if several users edit the same file? One also needs to
make sure, the path would be encoded into the name, but then we might
run into trouble with filename length limitations.
So I think it in the users responsibility to configure Vim correctly
(check the directory option) to not have him litter his document root
with old swap files.
The best I can think of currently, is to add a warning to the
documentation, that swapfiles may cause a security problem.
Christian
--
"Wenn man alle Gesetze studieren sollte, so hätte man gar keine
Zeit, sie zu übertreten."
-- Goethe, Maximen und Reflektionen, Nr. 347
--
--
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php
---
You received this message because you are subscribed to the Google Groups
"vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to vim_dev+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
