PT-2022-25314 · Zettlr · Zettlr

Carlos Bello · Published 2022-11-03 · Updated 2022-11-05 · CVE-2022-40276

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zettlr version 2.3.0

Description The issue allows an external attacker to remotely obtain arbitrary local files on any client that attempts to view a malicious markdown file through Zettlr. This is possible because the application does not have a Content Security Policy (CSP) or at least not a strict enough one, and/or does not properly validate the contents of markdown files before rendering them.

Recommendations For Zettlr version 2.3.0, consider implementing a strict Content Security Policy (CSP) and properly validating the contents of markdown files before rendering them to prevent exploitation. As a temporary workaround, restrict the rendering of markdown files from untrusted sources until a patch is available.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2022-40276

Affected Products

Zettlr

References · 5

• 🔥 https://fluidattacks.com/advisories/avicii · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-40276 · Security Note
• https://osv.dev/vulnerability/CVE-2022-40276 · Vendor Advisory
• https://github.com/Zettlr/Zettlr · Note
• https://t.me/cibsecurity/52531 · Telegram Post