Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, a privilege escalation vulnerability exists in the Joplin server, allowing non-admin users to exploit the API endpoint PATCH /api/users/:id to set the isadmin field to 1. The vulnerability allows malicious low-privileged users to perform administrative actions without proper authorization. This issue has been patched in version 3.3.3.

Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, path traversal is possible in Joplin Server if static file path starts with css/pluginAssets or js/pluginAssets. The findLocalFile function in the default route calls localFileFromUrl to check for special pluginAssets paths. If the function returns a path, the result is returned directly, without checking for path traversal. The vulnerability allows attackers to read files outside the intended directories. This issue has been patched in version 3.3.3.

Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. This vulnerability is caused by adding note titles to the document using React's dangerouslySetInnerHTML, without first escaping HTML entities. Joplin lacks a Content-Security-Policy with a restrictive script-src. This allows arbitrary JavaScript execution via inline onclick/onload event handlers in unsanitized HTML. Additionally, Joplin's main window is created with nodeIntegration set to true, allowing arbitrary JavaScript execution to result in arbitrary code execution. Anyone who 1) receives notes from unknown sources and 2) uses <kbd>ctrl</kbd>-<kbd>p</kbd> to search is impacted. This issue has been addressed in version 3.1.24 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. This vulnerability is caused by differences between how Joplin's HTML sanitizer handles comments and how the browser handles comments. This affects both the Rich Text Editor and the Markdown viewer. However, unlike the Rich Text Editor, the Markdown viewer is cross-origin isolated, which prevents JavaScript from directly accessing functions/variables in the toplevel Joplin window. This issue is not present in Joplin 3.1.24 and may have been introduced in 9b50539. This is an XSS vulnerability that impacts users that open untrusted notes in the Rich Text Editor. This vulnerability has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Joplin's HTML sanitizer allows the name attribute to be specified. If name is set to the same value as an existing document property (e.g. querySelector), that property is replaced with the element. This vulnerability's only known impact is denial of service. The note viewer fails to refresh until closed and re-opened with a different note. This issue has been addressed in version 3.2.8 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Joplin is an open source, privacy-focused note taking app with sync capabilities for Windows, macOS, Linux, Android and iOS. In affected versions attackers are able to abuse the fact that openExternal is used without any filtering of URI schemes to obtain remote code execution in Windows environments. This issue has been addressed in version 3.0.3 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Summary

There is a vulnerability in Joplin-desktop that leads to remote code execution (RCE) when a user clicks on an <a> link within untrusted notes. The issue arises due to insufficient sanitization of <a> tag attributes introduced by the Mermaid. This vulnerability allows the execution of untrusted HTML content within the Electron window, which has full access to Node.js APIs, enabling arbitrary shell command execution.

Details

In the markdown preview iframe, Joplin only opens <a> links internally within the same Electron window if they contain the data-from-md attribute. While Joplin successfully sanitizes the data-from-md attribute in user-embedded <a> links from the .md file to prevent the execution of untrusted HTML content, it fails to sanitize the data-from-md attributes of <a> tags introduced by Mermaid (e.g., the code snippet shown below). Since Mermaid allows the rendering of certain scriptless HTML elements, an attacker can embed <a> tags with data-from-md attributes, which will then be opened internally in the same Electron window.

Additionally, Joplin opens the window with nodeIntegration set to true and contextIsolation set to false, resulting in any scripts running in the opened window having full access to Node.js APIs. Furthermore, the markdown preview iframe shares the same origin (i.e.,local file system) as its parent and lacks the sandbox attribute, allowing scripts running in the iframe to call Node.js APIs through window.parent. As a result, an attacker can execute arbitrary code using Node.js APIs by exploiting HTML files stored on the local file system, which share the same origin as the parent.

Relevant code references:

+ Payload to inject <a> with data-from-md attribute:

markdown mermaid flowchart TD A[<a href="https://attacker.com" data-from-md>hello</a>]

+ Handling link navigation in the markdown preview iframe

https://github.com/laurent22/joplin/blob/e6c09da639adeb76f12e4477cc8442c49c0ced0c/packages/lib/renderers/webviewLib.js#L93-L116

+ Window configuration of Joplin window

https://github.com/laurent22/joplin/blob/e6c09da639adeb76f12e4477cc8442c49c0ced0c/packages/app-desktop/ElectronAppWrapper.ts#L141-L155

PoC

Considering the user has downloaded the following shared files from the internet (Note: the threat model aligns with existing published security issues: GHSA-2h88-m32f-qh5m and GHSA-g8qx-5vcm-3x59, where the malicious HTML file is available locally):

+ poc.md markdown mermaid flowchart TD A[<a href="/../../../../../../../../../../../../../../../path/to/poc2.html" data-from-md>hello</a>]

+ poc2.html <html> <body> <script> if (typeof window.parent.require !== 'undefined') { const { exec } = window.parent.require('childprocess'); exec('ls -al', (err, stdout, stderr) => { if (err) { document.body.innerText = Error: ${err.message}; return; } if (stderr) { document.body.innerText = Stderr: ${stderr}; return; } document.body.innerText = stdout; }); } else { document.body.innerText = 'Require is not available in this environment.'; } </script> </body> </html>

Then, open the poc.md with Joplin and click on the hello link. The code embedded in the poc2.html will be executed.

!result

Impact

This vulnerability can lead to Remote Code Execution (RCE) when users open and interact with untrusted notes, while malicious HTML files are available locally.

Joplin is a free, open source note taking and to-do application. Joplin fails to take into account that "<" followed by a non letter character will not be considered html. As such it is possible to do an XSS by putting an "illegal" tag within a tag.

Joplin is a free, open source note taking and to-do application. A Cross site scripting (XSS) vulnerability in affected versions allows clicking on an untrusted image link to execute arbitrary shell commands. The HTML sanitizer (packages/renderer/htmlUtils.ts::sanitizeHtml) preserves <map> <area> links. However, unlike <a> links, the target and href attributes are not removed. Additionally, because the note preview pane isn't sandboxed to prevent top navigation, links with target set to top can replace the toplevel electron page. Because any toplevel electron page, with Joplin's setup, has access to require and can require node libraries, a malicious replacement toplevel page can import childprocess and execute arbitrary shell commands. This issue has been fixed in commit 7c52c3e9a81a52ef1b42a951f9deb9d378d59b0f which is included in release version 2.12.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Joplin before 2.11.5 allows XSS via an AREA element of an image map.

Joplin before 2.11.5 allows XSS via a USE element in an SVG document.

Cross Site Scripting vulnerability in Joplin Desktop App before v2.9.17 allows attacker to execute arbitrary code via improper santization.

Cross Site Scripting (XSS) vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribrary code due to improper sanitizing of html.

Joplin 2.6.10 allows remote attackers to execute system commands through malicious code in user search results.

Joplin before 2.0.9 allows Cross-site Scripting via button and form in the note body.

Joplin 1.2.6 for Desktop allows XSS via a LINK element in a note.

An XSS issue in Joplin desktop 1.0.190 to 1.0.245 allows arbitrary code execution via a malicious HTML embed tag.

Joplin through 1.0.184 allows Arbitrary File Read via XSS.

Joplin version prior to 1.0.90 contains a Cross-site Scripting (XSS) evolving into code execution due to enabled nodeIntegration for that particular BrowserWindow instance where XSS was identified from vulnerability in Note content field - information on the fix can be found here https://github.com/laurent22/joplin/commit/494e235e18659574f836f84fcf9f4d4fcdcfcf89 that can result in executing unauthorized code within the rights in which the application is running. This attack appear to be exploitable via Victim synchronizing notes from the cloud services or other note-keeping services which contain malicious code. This vulnerability appears to have been fixed in 1.0.90 and later.