CVE-2021-33041

2021-05-17T00:00:00
ID AKB:6C11F6C0-2D4D-49BD-8FB3-E65745DED070
Type attackerkb
Reporter AttackerKB
Modified 2021-05-25T00:00:00

Description

vmd through 1.34.0 allows ‘div class=“markdown-body”’ XSS, as demonstrated by Electron remote code execution via require(‘child_process’).execSync(‘calc.exe’) on Windows and a similar attack on macOS.

Recent assessments:

nu11secur1ty at July 10, 2021 9:46pm UTC reported:

CVE-2021-33041

If someone malicious guy sends MD file with malicious content, and for example, the user is a real user ;) and don’t know what actually is going on, and open the file with VMD, boom, the game is over for him.

Proof:

<https://streamable.com/j7e13y> – low
<https://streamable.com/oykc86> – medium
<https://streamable.com/yywb0h> – high
<https://streamable.com/ngx2xm> – very high

M0r3:

<https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-33041>

BR

Assessed Attacker Value: 5
Assessed Attacker Value: 5Assessed Attacker Value: 3