| عنوان | https://github.com/logseq logseq 2.0.1 Local Sensitive Logic exposure lead to Command Execution |
|---|
| الوصف | The Logseq desktop app embeds a local HTTP API server (Fastify, listening on 127.0.0.1:12315 by default; started by the user from the API icon in the app's top-right corner, or configured to start automatically with the app). Its POST /api endpoint forwards the method name given in the request body to the app's renderer process and invokes any exported plugin-SDK function by name. The server's authentication logic depends on a token list the user configures in advance: when the token list is empty (the default installation state), the authentication function is skipped entirely and a request carrying any forged Authorization value passes authentication — the default configuration holds no valid credentials, the when-let short-circuits on the nil token list, and every token comparison is skipped — leaving every endpoint open to any requester. The server also enables CORS with Access-Control-Allow-Origin: *, so any website can call these endpoints cross-origin from a browser and read the responses.
The victim is running Logseq with the API Server started (tokens kept at the default empty list), then opens an attacker-controlled web page in a browser. JavaScript on that page sends cross-origin requests to http://127.0.0.1:12315/api and performs, in order:
Arbitrary write to any path: it calls logseq.app.writeDotdirFile(file, content, subRoot) and abuses the directory traversal in the third parameter (sub-root) to write a file with an arbitrary name and arbitrary content (binary content supported) to any path under the victim's home directory — for example a .bat script dropped into the Windows Startup folder, achieving persistent arbitrary command execution (Linux/macOS equivalent landing spots: ~/.config/autostart/*.desktop, ~/Library/LaunchAgents/*.plist, ~/.bashrc);
Immediate execution: it calls logseq.app.openExternalLink and abuses the double allow of its substring-style check and the preload-level file: protocol allowlist to make the app's main process call shell.openExternal with a file:///…?ref=https://… URL, launching the just-written script (or any local executable) immediately through the system ShellExecuteEx.
Both requests take effect as soon as they are sent; whether the browser reads the responses has no bearing on the outcome of the command execution. To the victim the entire attack appears as opening an ordinary web page, after which attacker-chosen commands execute on the system. The getCurrentGraph endpoint returns the current graph's local absolute path, locating the home directory for assembling absolute landing paths such as %TEMP% and the Startup folder (an information-gathering half-step). The command output can then be read back to the attacker's page through the loadPluginReadme primitive on the same unauthenticated server (its directory argument is fully caller-controlled and it reads readme.md from that directory), yielding full command execution with output retrieval.
|
|---|
| المصدر | ⚠️ https://github.com/logseq/logseq/issues/13596 |
|---|
| المستخدم | akamoli (UID 101918) |
|---|
| ارسال | 15/10/2026 02:48 PM (24 أيام منذ) |
|---|
| الاعتدال | 08/11/2026 05:51 PM (24 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 432919 [logseq 2.0.1/2.0.2 Local HTTP API server.cljs validate-auth-token توثيق ضعيف] |
|---|
| النقاط | 20 |
|---|