PT-2024-12733 · Joplin+2 · Joplin+2

Personalizedrefrigerator · Published 2024-06-21 · Updated 2025-04-11 · CVE-2023-38506

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Joplin versions prior to 2.12.10

Description A Cross-site Scripting (XSS) issue in Joplin allows the execution of arbitrary code when pasting untrusted data into the rich text editor. This occurs because HTML pasted into the editor is not properly sanitized, enabling the onload attribute of pasted images to execute arbitrary code. Since the TinyMCE editor frame lacks the sandbox attribute, scripts can access NodeJS's require through the top variable, allowing an attacker to run arbitrary commands.

Recommendations For versions prior to 2.12.10, upgrade to version 2.12.10 or later to resolve the issue. As a temporary workaround, consider disabling the rich text editor feature until a patch is available. Restrict access to untrusted data to minimize the risk of exploitation. Avoid pasting untrusted HTML into the rich text editor until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-38506

GHSA-M59C-9RRJ-C399

Affected Products

Joplin

Node.Js

Tinymce

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38506.json · Exploit
• https://github.com/laurent22/joplin/security/advisories/GHSA-m59c-9rrj-c399 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-38506 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38506 · Security Note
• https://twitter.com/VulmonFeeds/status/1804341116243771548 · Twitter Post
• https://t.me/cvenotify/118884 · Telegram Post