Joplin Remote Code Execution

Description

Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existing links in the markdown file before passing them to the shell.openExternal function.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 2.8.8

References

• GHSA-mjr5-v9c9-mm7g
• fluidattacks.com
• CVE-2022-40277
• CWE-20
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Remote code execution via MongoDB BSON parser through prototype pollution - CVE-2022-39396
• Remote Code Execution on click of <a> Link in markdown preview - CVE-2024-49362
• Joplin is vulnerable to arbitrary code execution - CVE-2022-35131
• Remote code execution in Eclipse Theia - CVE-2021-34435

Tags:

npm

joplin