PT-2024-12815 · Joplin · Joplin

Personalizedrefrigerator · Published 2024-06-21 · Updated 2024-09-26 · CVE-2023-39517

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Joplin versions prior to 2.12.8

Description A Cross site scripting (XSS) vulnerability in Joplin allows clicking on an untrusted image link to execute arbitrary shell commands. The HTML sanitizer preserves <map> <area> links, but unlike <a> links, the target and href attributes are not removed. This allows links with target set to top to replace the top-level electron page, which can then import child process and execute arbitrary shell commands.

Recommendations For versions prior to 2.12.8, upgrade to release version 2.12.8 or later to fix the issue. As a temporary workaround, consider disabling the packages/renderer/htmlUtils.ts::sanitizeHtml function until a patch is available. Restrict access to untrusted image links to minimize the risk of exploitation. Avoid using the target and href attributes in links until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-39517

GHSA-2H88-M32F-QH5M

Affected Products

Joplin

References · 7

• 🔥 https://github.com/laurent22/joplin/security/advisories/GHSA-2h88-m32f-qh5m · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39517.json · Exploit
• https://github.com/laurent22/joplin/commit/7c52c3e9a81a52ef1b42a951f9deb9d378d59b0f · Patch
• https://osv.dev/vulnerability/CVE-2023-39517 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-39517 · Security Note
• https://twitter.com/VulmonFeeds/status/1804344404397723903 · Twitter Post
• https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#sandbox · Note