CVE-2021-36753
📋 TL;DR
CVE-2021-36753 is a path traversal vulnerability in sharkdp's BAT syntax highlighter where the application executes less.exe from the current working directory instead of the system PATH. This allows attackers to execute arbitrary code by placing a malicious less.exe file in a directory that a user then runs BAT from. All users of BAT versions before 0.18.2 are affected.
💻 Affected Systems
- sharkdp BAT
📦 What is this software?
Bat by Bat Project
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via arbitrary code execution with the privileges of the user running BAT, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Local privilege escalation or arbitrary code execution when users run BAT from untrusted directories containing malicious less.exe files.
If Mitigated
Limited impact if users only run BAT from trusted directories and have proper file permissions restricting write access to those directories.
🎯 Exploit Status
Exploitation requires the attacker to place a malicious less.exe in a directory and convince the user to run BAT from that directory. Public proof-of-concept exists in the advisory references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.18.2 and later
Vendor Advisory: https://github.com/sharkdp/bat/releases/tag/v0.18.2
Restart Required: No
Instructions:
1. Update BAT using your package manager (apt, yum, brew, etc.) 2. Or download and install version 0.18.2+ from GitHub releases 3. Verify the update with 'bat --version'
🔧 Temporary Workarounds
Disable less pager
allConfigure BAT to not use less as the pager, preventing the vulnerable code path
export BAT_PAGER=""
Use absolute PATH for less
linuxEnsure less is only executed from system PATH by modifying environment
export PATH="/usr/bin:$PATH"
🧯 If You Can't Patch
- Restrict user permissions to prevent writing executable files to directories where BAT might be run
- Educate users to never run BAT from untrusted or shared directories
🔍 How to Verify
Check if Vulnerable:
Run 'bat --version' and check if version is below 0.18.2Check Version:
bat --versionVerify Fix Applied:
Run 'bat --version' and confirm version is 0.18.2 or higher📡 Detection & Monitoring
Log Indicators:
- Process execution of less.exe from non-standard directories
- BAT process spawning unexpected child processes
Network Indicators:
- Unusual outbound connections following BAT execution
SIEM Query:
Process Creation where (Image contains "less.exe" and ParentImage contains "bat.exe") OR (CommandLine contains "less" and ParentImage contains "bat")🔗 References
- https://github.com/sharkdp/bat/commit/bf2b2df9c9e218e35e5a38ce3d03cffb7c363956
- https://github.com/sharkdp/bat/pull/1724
- https://github.com/sharkdp/bat/releases/tag/v0.18.2
- https://vuln.ryotak.me/advisories/53
- https://github.com/sharkdp/bat/commit/bf2b2df9c9e218e35e5a38ce3d03cffb7c363956
- https://github.com/sharkdp/bat/pull/1724
- https://github.com/sharkdp/bat/releases/tag/v0.18.2
- https://vuln.ryotak.me/advisories/53
