CVE-2024-25255: Sublime Text 4 RCE Vulnerability

CVE-2024-25255 Overview

Sublime Text 4 contains a command injection vulnerability within the New Build System module. This vulnerability allows attackers to execute arbitrary operating system commands through the build system configuration. It's important to note that multiple third parties have reported this behavior as intended functionality, as the build system is designed to execute shell commands for compilation and build processes.

Critical Impact

Command injection in Sublime Text 4's Build System module could allow attackers to execute arbitrary OS commands with the privileges of the user running the application.

Affected Products

• Sublime Text 4

Discovery Timeline

• November 11, 2024 - CVE CVE-2024-25255 published to NVD
• December 24, 2024 - Last updated in NVD database

Technical Details for CVE-2024-25255

Vulnerability Analysis

This command injection vulnerability (CWE-77) exists in the New Build System module of Sublime Text 4. The build system functionality allows users to define custom build configurations that can execute shell commands. While this is a core feature enabling developers to compile code and run scripts, the implementation can be exploited to inject and execute arbitrary operating system commands.

The vulnerability is accessible over the network and requires no authentication or user interaction, making it particularly concerning in scenarios where malicious build configuration files could be distributed or where users open untrusted projects containing crafted build system definitions.

Root Cause

The root cause stems from how Sublime Text's Build System processes the shell_cmd option and related exec target configurations. When a build system configuration is executed, the commands specified are passed to the operating system shell without sufficient sanitization, allowing command injection through specially crafted build system files.

Attack Vector

An attacker could exploit this vulnerability by crafting a malicious Sublime Text build system configuration file (.sublime-build) that contains injected shell commands. When a victim opens a project containing this malicious build configuration and triggers a build operation, the injected commands execute with the user's privileges.

The attack could be delivered through:

• Malicious code repositories containing crafted build files
• Shared project configurations distributed via collaboration platforms
• Social engineering to convince users to import malicious build configurations

The vulnerability leverages the shell command execution feature documented in Sublime Text's Build Systems Documentation, specifically through the shell_cmd option that passes commands directly to the system shell.

Detection Methods for CVE-2024-25255

Indicators of Compromise

• Unexpected or unfamiliar .sublime-build files appearing in project directories
• Build system configurations containing obfuscated or encoded shell commands
• Unusual system processes spawned as child processes of Sublime Text
• Network connections initiated from Sublime Text to unknown external hosts

Detection Strategies

• Monitor file system for creation or modification of .sublime-build files in project directories
• Implement endpoint detection rules to identify suspicious command execution chains originating from Sublime Text
• Review build system configurations in new projects before execution
• Enable process monitoring to detect anomalous child processes spawned by text editors

Monitoring Recommendations

• Configure endpoint protection to alert on shell command execution from code editor processes
• Implement file integrity monitoring for Sublime Text configuration directories
• Review recently accessed projects and their build configurations regularly
• Deploy behavioral analysis to identify unusual command patterns from development tools

How to Mitigate CVE-2024-25255

Immediate Actions Required

• Review all existing build system configurations (.sublime-build files) in active projects
• Avoid opening projects from untrusted sources without first inspecting build configurations
• Disable automatic build execution features when working with unfamiliar codebases
• Restrict Sublime Text's ability to execute arbitrary shell commands in sensitive environments

Patch Information

As multiple third parties have reported this behavior as intended functionality, no official patch addressing this vulnerability has been released. The build system's ability to execute shell commands is a core feature designed for developer productivity. Users should exercise caution when working with build configurations from untrusted sources.

For additional context, refer to the Sublime Text Forum Discussion on this CVE.

Workarounds

• Manually inspect all .sublime-build files in projects before opening them in Sublime Text
• Use Sublime Text's safe mode or disable plugins when working with untrusted projects
• Implement organizational policies restricting build system usage to approved configurations only
• Consider using sandboxed environments when working with code from unknown sources
• Review and whitelist only trusted build configurations in team environments

# Configuration example
# Review build system files before opening projects
find /path/to/project -name "*.sublime-build" -exec cat {} \;

# Check for suspicious shell commands in build configurations
grep -r "shell_cmd" /path/to/project --include="*.sublime-build"