PT-2024-28722 · Vnote · Vnote

Hijack-Everything · Published 2024-07-11 · Updated 2024-07-11 · CVE-2024-39904

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VNote versions prior to 3.18.1

Description A code execution issue existed in VNote, allowing an attacker to execute arbitrary programs on the victim's system. This could be achieved by using a crafted URI in a note, such as file:///C:/WINDOWS/system32/cmd.exe or file:///C:/WINDOWS/system32/calc.exe, which references a local executable file. The vulnerability can be exploited by creating and sharing specially crafted notes, potentially leading to further attacks.

Recommendations For versions prior to 3.18.1, update to version 3.18.1 to resolve the issue. As a temporary workaround, consider avoiding the use of file:/// links in notes until the update is applied. Restrict access to sharing notes from untrusted sources to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-73

Related Identifiers

CVE-2024-39904

GHSA-VHH5-8WCV-68GJ

Affected Products

Vnote

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39904.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-39904 · Security Note
• https://osv.dev/vulnerability/CVE-2024-39904 · Vendor Advisory
• https://github.com/vnotex/vnote/commit/3477469b669708ff547037fda9fc2817870428aa · Note
• https://github.com/vnotex/vnote/security/advisories/GHSA-vhh5-8wcv-68gj · Note
• https://twitter.com/CVEnew/status/1811428034458575294 · Twitter Post
• https://twitter.com/CveFindCom/status/1811430653616894083 · Twitter Post
• https://t.me/cvedetector/663 · Telegram Post