MacDownApp / MacDownApp/macdown
Macdown Version 0.7.1 (870) Remote Code Execution
Nobody has claimed this yet.
- Dominant language
- Rich Text Format
- Stars
- 9.8k
- Forks
- 1.2k
- PR merge metrics
- No merged PRs in 30d
Description
## Macdown Version 0.7.1 (870) Remote Code Execution
Macdown version 0.7.1 (870) is affected by a remote code execution vulnerability. Macdown fails to sanitize input on HTML attributes. Abusing the`file:\\` URI scheme on HTML attributes can result in arbitrary code execution. The attached proof of concept will execute the MacOS Calculator.app when opened inside of Macdown.
PoC (PoC.md):
```
(function download() {
document.getElementById('exploit').click();
})()
```
Screenshot:
[PoC.md.zip](https://github.com/MacDownApp/macdown/files/2801219/PoC.md.zip)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by opening the attached PoC.md in MacDown 0.7.1 to reproduce the Calculator.app launch. Locate the HTML attribute sanitization path and determine how file: URIs are handled. Done means the PoC cannot execute an application and regression coverage protects against file URI execution.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- html, macos
- Domain
- desktop, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100