Summary

An XSS vulnerability allows note titles to execute arbitrary shell commands from the ctrl+p search dialog.

Details

This vulnerability is caused by adding note titles to the document using React's dangerouslySetInnerHTML, without first escaping HTML entities:

Joplin lacks a Content-Security-Policy with a restrictive script-src. This allows arbitrary JavaScript execution via inline onclick/onload event handlers in unsanitized HTML. Additionally, Joplin's main window is created with nodeIntegration set to true, allowing arbitrary JavaScript execution to result in arbitrary code execution.

A git blame suggests that this vulnerability has existed since at least March 2020. A similar vulnerability may have existed before then — older logic used surroundKeywords on untrusted input, which also did not escape HTML.

PoC

1. Create a note with the following title:

    <style onload="alert(require('child_process').execSync('ls /'))"></style>
   

2. Add someuniqueword to the note body.
3. Press ctrl-p and search for someuniqueword.

Tested versions: 3.1.20, 3.0.14, and 2.14.23.

t<style onload="require('child_process').exec('zenity --error')">*{}</style>t

Impact

Anyone who 1) receives notes from unknown sources and 2) uses ctrl-p to search is impacted.