CVE-2022-4515

What it actually does

A crafted tag filename passed via the -o option or configuration file triggers unsafe system(3) invocation inside externalSortTags() in sort.c, resulting in arbitrary command execution.

Why it matters to the business

Attackers can run arbitrary commands on developer or build systems that invoke exuberant ctags, potentially leading to source code theft, build pipeline compromise, or lateral movement; the issue remains unpatched in listed distributions and affects widely used open-source tooling.

How an attack unfolds

An attacker supplies a malicious filename containing shell metacharacters through the command line or a ctags configuration file; when ctags processes tags and calls externalSortTags(), the embedded system(3) call executes the attacker-supplied commands with the privileges of the invoking user or process.

How to fix it

Migrate from unmaintained exuberant ctags to universal-ctags; if migration is impossible, avoid passing untrusted input to the -o option and do not allow user-controlled values in ctags configuration files.

How to confirm the fix worked

Run ctags --version to confirm the exuberant variant is present; test in an isolated environment that a filename containing shell metacharacters is no longer executed when supplied via -o.

Typical attack path

1. Create a filename containing shell metacharacters and desired commands
2. Invoke exuberant ctags with the -o option or place the filename in a .ctags configuration file
3. Trigger tag sorting so externalSortTags() executes the system(3) call
4. Commands run under the privileges of the ctags process

How to detect it

Search process execution logs and shell history for ctags invocations whose -o argument contains shell metacharacters such as ; | & or $(); correlate with subsequent unexpected command execution or file creation by the same user context.

• ctags -o.*[;&|`$]
• externalSortTags
• ctags.*\.ctags.*command

What your security team should do

• Inventory all uses of exuberant ctags across build pipelines and developer workstations
• Block or sanitize any user-supplied values passed to the -o option
• Replace exuberant ctags with universal-ctags in all supported distributions
• Add runtime restrictions or sandboxing around ctags invocations until replacement is complete