Executive brief
Joplin is a popular open-source note-taking application that allows users to capture and organize content. A cross-site scripting (XSS) vulnerability in its HTML rendering engine could allow an attacker to inject malicious scripts into notes, potentially leading to unauthorized access to local files or sensitive data stored within the application.
Technical details
This is a cross-site scripting (CWE-79) vulnerability in Joplin's Markdown-to-HTML rendering pipeline, specifically in the HTML sanitization rules. The vulnerability exists in versions up to 1.0.184 and was patched in version 1.2.1. An authenticated user or attacker with the ability to craft a malicious note containing specially crafted HTML/script content can exploit insufficient input sanitization in the MdToHtml rendering component. The attack requires user interaction (rendering a malicious note) and leverages the presence of renderer context, allowing arbitrary file read via injected JavaScript. A patch was committed on 2020-02-13 and released as part of version 1.2.1.
Affected products
- Joplin Joplin through 1.0.184
Timeline
- 2020-02-17: disclosed
- 2020-02-13: patched: Security fix committed
- 2020-10-13: advisory: GitHub advisory published