laurent22 joplin up to 2.12.8 MarkupToHtml.ts child_process cross site scripting

Summaryinfo

A vulnerability was found in laurent22 joplin up to 2.12.8. It has been rated as problematic. This vulnerability affects the function child_process of the file packages/renderer/MarkupToHtml.ts. This manipulation causes cross site scripting. This vulnerability is tracked as CVE-2023-37898. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in laurent22 joplin up to 2.12.8 and classified as problematic. Affected by this vulnerability is the function child_process of the file packages/renderer/MarkupToHtml.ts. The manipulation with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. The summary by CVE is:

Joplin is a free, open source note taking and to-do application. A Cross-site Scripting (XSS) vulnerability allows an untrusted note opened in safe mode to execute arbitrary code. `packages/renderer/MarkupToHtml.ts` renders note content in safe mode by surrounding it with and , without escaping any interior HTML tags. Thus, an attacker can create a note that closes the opening tag, then includes HTML that runs JavaScript. Because the rendered markdown iframe has the same origin as the toplevel document and is not sandboxed, any scripts running in the preview iframe can access the top variable and, thus, access the toplevel NodeJS `require` function. `require` can then be used to import modules like fs or child_process and run arbitrary commands. This issue has been addressed in version 2.12.9 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

The advisory is shared at github.com. This vulnerability is known as CVE-2023-37898 since 07/10/2023. The exploitation appears to be easy. The attack can be launched remotely. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1059.007 for this issue.

Upgrading to version 2.12.9 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• laurent22

Name

• joplin

Version

• 2.12.0
• 2.12.1
• 2.12.2
• 2.12.3
• 2.12.4
• 2.12.5
• 2.12.6
• 2.12.7
• 2.12.8

Website

• Product: https://github.com/laurent22/joplin/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion