PT-2024-33486 · Mermaid+3 · Mermaid+3

Jackfromeast · Published 2024-11-14 · Updated 2024-11-15 · CVE-2024-49362

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Joplin-desktop (affected versions not specified)

Description The issue arises due to insufficient sanitization of <a> tag attributes introduced by the Mermaid, allowing the execution of untrusted HTML content within the Electron window. This enables arbitrary shell command execution when a user clicks on an <a> link within untrusted notes. The markdown preview iframe shares the same origin as its parent and lacks the sandbox attribute, allowing scripts running in the iframe to call Node.js APIs through window.parent.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Code Injection

XSS

Weakness Enumeration

CWE-94

CWE-79

Related Identifiers

CVE-2024-49362

GHSA-HFF8-HJWV-J9Q7

Affected Products

Electron

Joplin-Desktop

Mermaid

Node.Js

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/49xxx/CVE-2024-49362.json · Exploit
• https://github.com/laurent22/joplin/security/advisories/GHSA-hff8-hjwv-j9q7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-49362 · Security Note
• https://osv.dev/vulnerability/GHSA-hff8-hjwv-j9q7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-49362 · Vendor Advisory
• https://github.com/laurent22/joplin · Note
• https://twitter.com/VulmonFeeds/status/1857256261026230689 · Twitter Post
• https://twitter.com/CVEnew/status/1857119158212722743 · Twitter Post