发布 2023-05-23 漏洞条目

Gin Markdown Editor v0.7.4 (Electron) – Arbitrary Code Execution

Exploit Source

# Exploit Title: Gin Markdown Editor v0.7.4 (Electron) - Arbitrary Code Execution

# Date: 2023-04-24

# Exploit Author: 8bitsec

# CVE: CVE-2023-31873

# Vendor Homepage: https://github.com/mariuskueng/gin

# Software Link: https://github.com/mariuskueng/gin

# Version: 0.7.4

# Tested on: [Mac OS 13]

Release Date:

2023-04-24

Product & Service Introduction: Javascript Markdown editor for Mac

Technical Details & Description:

A vulnerability was discovered on Gin markdown editor v0.7.4 allowing a user to execute arbitrary code by opening a specially crafted file.

Proof of Concept (PoC):

Arbitrary code execution:

Create a markdown file (.md) in any text editor and write the following payload:

Opening the file in Gin will auto execute the Calculator application.

相关漏洞条目