search

zhuzhuyule / HexoEditor

this markdown Editor for hexo blog
GNU General Public License v3.0
1.22k stars 151 forks source link

XSS to code execution vulnerability #3

Open silviavali opened 6 years ago

silviavali commented 6 years ago

As this project has inherited the Moeditor based on the information received here: https://github.com/Moeditor/Moeditor/issues/156

I would like to report XSS to code execution vulnerability in HexoEditor version 1.1.8 . Please do contact me at silviavali14@gmail.com for the poc.

zhuzhuyule commented 6 years ago

hello, what's problem ?

silviavali commented 6 years ago

Update: Report sent attached to the e-mail

silviavali commented 6 years ago

"XSS to code execution vulnerability due to enabled node integration"

Vulnerability: XSS to code execution Version: 1.1.8 Initially reported: January 3rd, 2018 Tested on 16.04.1-Ubuntu

PoC: paste the following payload as the content of the markdown file: 

<s <onmouseover="alert(1)"> <s onmouseover="var {shell} = require('electron');
shell.openExternal('file:/etc/passwd'); alert('XSS to code execution')">Hallo</s>

image

then, if you now hover over the word Hallo, the '/etc/passwd' file and an alert with words “XSS to code execution” will pop up: image

Attack vector: If the victim is forced or tricked into pasting such code or open a crafted file in the markdown editor, it is possible for the attacker to steal user’s data from the computer or perform any actions on the machine on which the application running on.