Executive brief
Joplin is a popular open-source note-taking application that allows users to create and organize notes across multiple devices. An attacker can inject malicious JavaScript code into a note by embedding it within a LINK HTML element, which is then executed when the note is rendered, potentially allowing the attacker to steal user data or impersonate the user within the application.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw (CWE-79) caused by insufficient sanitization of HTML tags in note content. Specifically, the LINK and META tags are not properly filtered before rendering notes in the user interface. An attacker can craft a malicious note containing a LINK tag with JavaScript code (e.g., via event handlers or href attributes pointing to javascript: URIs), and when any user views that note, the script executes in their browser context with their privileges. The attack requires user interaction (opening/viewing the note) but no authentication bypass. The fix, released in version 1.3.11, removes LINK and META tags from note HTML during rendering to prevent XSS.
Affected products
- Joplin Project Joplin all versions before 1.3.11
Timeline
- 2020-11-06: disclosed
- 2021-05-10: patched: fix released in Joplin 1.3.11