Remote code execution vulnerability in Electron based Neat Reader versions #20
Description
Hey, I've discovered a vulnerability in Neat Reader. I'm sticking to GitHub's default template for advisories (maybe consider adding a SECURITY.md):
Summary
Opening an ebook with malicious scripts inside can lead to remote code execution on the users's machine.
Testing was done on version 8.1.4 for Windows. The web version is also vulnerable.
Details
Content is not properly sandboxed (e.g. an iframe with proper sandbox configuration), which means the execution of JavaScript from inside an ebook is possible.
In the case of Neat Reader with Electron, exploitation is really simple, as the attacker has access to the node integration.
PoC
An ebook can be crafted with Calibre to include this bare minimum script:
window.top.require("child_process").execSync("calc");That's it!
Impact
Users have to open a malicious file.
However, the attacker doesn't have to prepare a book specifically for Neat Reader, but can use some fingerprinting to determine in what environment it's running.
Distribution of malicious books could be done via pirate sites or even (online) conversion services, which could inject those malicious scripts.
Some ideas
In an ideal world, scripted content would be turned off. There are, however, limitations with that approach.
The author of foliate sums it up nicely here.
Maybe the user could be given the option to toggle scripted content.
That's it! If something's unclear, please ask away.
Cheers
Frederic
PS: Audio warning for the PoC videos!
Windows PoC:
https://github.com/Gauzytech/NeatReaderBugReport/assets/36849099/e2e32e95-32b3-45f6-a574-1b90da715b2c