Cross-site Scripting (XSS) Vulnerability in Joplin Affects Arbitrary Shell Commands Execution
CVE-2023-39517

5.4MEDIUM

Key Information:

Vendor

Laurent22

Status
Joplin
Vendor
CVE Published:
21 June 2024

What is CVE-2023-39517?

A Cross Site Scripting (XSS) vulnerability exists in the Joplin Note Taking Application allowing an attacker to execute arbitrary shell commands via untrusted image links. The vulnerability is due to the failure of the HTML sanitizer to adequately remove the target and href attributes from <map> and <area> elements, unlike proper sanitization of <a> links. Furthermore, because the note preview pane is not sandboxed to prevent top-level navigation, malicious links can replace the overarching Electron page. This replacement can grant access to sensitive functions, including the ability to call child_process and execute unauthorized shell commands. Users are strongly urged to upgrade to release version 2.12.8 or later to mitigate this risk as there are no known workarounds for this vulnerability.

Affected Version(s)

joplin < 2.12.8

References

https://github.com/laurent22/joplin/security/advisories/G...
x_refsource_CONFIRM
https://github.com/laurent22/joplin/commit/7c52c3e9a81a52...
x_refsource_MISC
https://developer.mozilla.org/en-US/docs/Web/HTML/Element...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.
CVE-2023-39517 : Cross-site Scripting (XSS) Vulnerability in Joplin Affects Arbitrary Shell Commands Execution