PT-2024-13269 · Joplin · Joplin

Laurent22 · Published 2024-06-21 · Updated 2025-04-11 · CVE-2023-45673

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Joplin versions prior to 2.13.3

Description A remote code execution issue in Joplin allows arbitrary shell commands to be executed when a user clicks on a link in a PDF within an untrusted note. This occurs because Joplin desktop has not disabled top redirection for note viewer iframes and has node integration enabled. The issue impacts users who attach untrusted PDFs to notes and have the icon enabled.

Recommendations For versions prior to 2.13.3, upgrade to version 2.13.3 to resolve the issue. As a temporary workaround, consider disabling the node integration or restricting the ability to click on links in PDFs within notes until the upgrade can be applied. Avoid using the note viewer iframe with untrusted notes until the issue is resolved.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2023-45673

GHSA-G8QX-5VCM-3X59

Affected Products

Joplin

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45673.json · Exploit
• https://github.com/laurent22/joplin/security/advisories/GHSA-g8qx-5vcm-3x59 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-45673 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-45673 · Security Note
• https://t.me/cvenotify/118885 · Telegram Post
• https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#sandbox · Note
• https://twitter.com/VulmonFeeds/status/1804341369277735015 · Twitter Post