CVE-2022-48624

What it actually does

The vulnerability allows local command injection because close_altfile in filename.c omits shell_quote when constructing the command from the LESSCLOSE environment variable, enabling arbitrary shell commands to execute with the privileges of the less process upon file close.

Why it matters to the business

Attackers with local access can run unauthorized commands on systems using affected less versions, potentially leading to data theft, system compromise, or lateral movement; widespread use of less in scripts and developer workflows increases exposure across many environments.

How an attack unfolds

An attacker with local access sets the LESSCLOSE environment variable to a malicious payload that includes unquoted commands, invokes less to open a file, and triggers close_altfile on exit so the shell executes the injected commands without sanitization.

How to fix it

Upgrade gwsw/less to the commit c6ac6de49698be84d264a0c4c0c40bb870b10144 or later versions that include shell_quote calls for LESSCLOSE; rebuild packages and redeploy affected systems; avoid setting LESSCLOSE from untrusted sources until patched.

How to confirm the fix worked

Confirm the installed less binary or source contains commit c6ac6de49698be84d264a0c4c0c40bb870b10144; test by setting a benign LESSCLOSE value and verifying no unexpected command execution occurs on file close.

Typical attack path

1. Obtain local access or influence over a user environment running less
2. Set LESSCLOSE to a command string containing shell metacharacters and the desired payload
3. Cause less to open then close a file (for example via a script or interactive session)
4. Execute arbitrary commands via the unsanitized LESSCLOSE invocation

How to detect it

Review shell history, process creation logs, and environment variable dumps for unusual LESSCLOSE values; inspect less invocations in audit logs or strace output for unexpected command execution immediately after file close operations.

• LESSCLOSE=.*[;&|`$]
• less.*close_altfile

What your security team should do

• Prioritize patching gwsw/less to the fixed commit across all systems and containers
• Audit scripts and user environments for use of LESSCLOSE and remove or sanitize it
• Monitor package repositories for updated less builds and enforce version pinning in builds