CVE-2022-23853
📋 TL;DR
This vulnerability allows arbitrary code execution when KDE Kate or KTextEditor opens a file from an untrusted directory. If the required LSP server binary isn't in the system PATH, the software incorrectly executes it from the file's directory instead. Users of affected KDE text editor versions are at risk.
💻 Affected Systems
- KDE Kate
- KTextEditor
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with user privileges when opening a malicious file from an untrusted source (like downloads folder or network share).
Likely Case
Local privilege escalation or malware execution when opening files from untrusted directories.
If Mitigated
No impact if patched versions are used or if users only open files from trusted directories.
🎯 Exploit Status
Exploitation requires user to open a malicious file from an untrusted directory containing a crafted LSP server binary.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Kate 21.12.2+, KTextEditor 5.91.0+
Vendor Advisory: https://kde.org/info/security/advisory-20220131-1.txt
Restart Required: Yes
Instructions:
1. Update system package manager. 2. Run: sudo apt update && sudo apt upgrade kate ktexteditor (Debian/Ubuntu) OR sudo dnf update kate ktexteditor (Fedora/RHEL). 3. Restart Kate/KTextEditor applications.
🔧 Temporary Workarounds
Disable LSP plugin
linuxTemporarily disable the Language Server Protocol plugin to prevent the vulnerable code path.
In Kate: Settings → Configure Kate → Plugins → uncheck 'LSP Client'
Restrict file opening locations
allOnly open files from trusted directories and avoid opening files from downloads, temporary, or network shares.
🧯 If You Can't Patch
- Disable LSP plugin in Kate/KTextEditor settings.
- Implement application whitelisting to prevent execution of unauthorized binaries from user directories.
🔍 How to Verify
Check if Vulnerable:
Check Kate version: kate --version | grep -E '21\.(1[0-1]|12\.0|12\.1)' OR check KTextEditor version via package manager.Check Version:
kate --version OR dpkg -l | grep kate OR rpm -q kate ktexteditorVerify Fix Applied:
Verify version is Kate 21.12.2+ or KTextEditor 5.91.0+: kate --version | grep -E '21\.12\.[2-9]|22\.' OR dpkg -l | grep -E 'kate|ktexteditor'📡 Detection & Monitoring
Log Indicators:
- Process execution from user directories (like Downloads) with Kate/KTextEditor parent process.
- Failed LSP server execution attempts from unusual locations.
Network Indicators:
- None - local exploitation only
SIEM Query:
Process creation where parent_process_name contains 'kate' AND process_path contains user directories like '/home/*/Downloads/' OR '/tmp/'