CVE-2022-40277

Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existing links in the markdown file before passing them to the 'shell.openExternal' function.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://fluidattacks.com/advisories/skrillex/	Exploit Third Party Advisory
https://github.com/laurent22/joplin	Product
https://fluidattacks.com/advisories/skrillex/	Exploit Third Party Advisory
https://github.com/laurent22/joplin	Product

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:joplinapp:joplin:2.8.8:*:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:a:joplinapp:joplin:2.8.8:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:-:*:*:*

History

No history.

Information

Published : 2022-09-30 17:15

Updated : 2024-11-21 07:21

NVD link : CVE-2022-40277

Mitre link : CVE-2022-40277

CVE.ORG link : CVE-2022-40277

JSON object : View

Products Affected

canonical

ubuntu_linux

linux

linux_kernel

joplinapp

joplin

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2022-40277", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2022-09-30T17:15:13.277", "references": [{"url": "https://fluidattacks.com/advisories/skrillex/", "tags": ["Exploit", "Third Party Advisory"], "source": "help@fluidattacks.com"}, {"url": "https://github.com/laurent22/joplin", "tags": ["Product"], "source": "help@fluidattacks.com"}, {"url": "https://fluidattacks.com/advisories/skrillex/", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/laurent22/joplin", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existing links in the markdown file before passing them to the 'shell.openExternal' function."}, {"lang": "es", "value": "Joplin versi\u00f3n 2.8.8, permite a un atacante externo ejecutar comandos arbitrarios de forma remota en cualquier cliente que abra un enlace en un archivo markdown malicioso, por medio de Joplin. Esto es posible porque la aplicaci\u00f3n no comprueba apropiadamente el esquema/protocolo de los enlaces existentes en el archivo markdown antes de pasarlos a la funci\u00f3n \"shell.openExternal\""}], "lastModified": "2024-11-21T07:21:10.653", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:joplinapp:joplin:2.8.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "91B75E51-3827-4240-9060-F261E9113717"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:joplinapp:joplin:2.8.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "91B75E51-3827-4240-9060-F261E9113717"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:-:*:*:*", "vulnerable": false, "matchCriteriaId": "652F5027-4436-458C-84FD-7AD89B489BAA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "help@fluidattacks.com"}