Vulnerability Type

Remote Code Execution (RCE)

Authentication Required?

No

Affected Location

• Search Notes > Search Ancestor (Output)
• Jump to Note > Search Note (Output)
• New Tab > Search Notes (Output)

Issue Summary

The application contains a vulnerability where HTML characters within the title name of notes are not properly sanitized, leaving it susceptible to cross-site scripting (XSS) attacks. If a victim searches for specific keywords, this vulnerability can be exploited, potentially leading to code execution. Notably, since the application is developed using Electron with ContextIsolation disabled and NodeIntegration enabled, the severity of this vulnerability could enable an attacker to execute commands on the system where the application is running.

Recommendation

Implement input validation and sanitization in the output of searching to ensure that HTML characters are properly escaped and cannot be used to trigger XSS attacks. Ensure to set NodeIntegration to 'FALSE' and ContextIsolation to 'TRUE' as this could protect against RCE attacks. Stay up-to-date with security patches and updates for all third-party libraries and dependencies used by the application.

Credits

Ali Radzali (muhammadali.radzali@baesystems.com)

Issue Reproduction

Create a new note and insert the payload below into the title of the note.

<img src=x onerror=require(`child_process`).execSync(`/usr/bin/mate-calc`)

NOTE: Triggering the XSS payload is not limited to using double quotes. In the case of this particular payloads, only the characters `, 1, #, ", > can be used to trigger the XSS.

Search Notes (Ancestor)

Click on "Search Notes" on the left sidebar and search for double quotes ("). This should trigger the XSS payload in the title of the note.

Jump to Notes (Note)

Click on "Jump to Note" on the left sidebar and search for double quotes ("). This should trigger the XSS payload in the title of the note.

New Tab (Note)

Create a new tab and search for double quotes ("). This could trigger the XSS payload in the title of the note.

Impact

This vulnerability allows an an attacker to execute arbitrary code on the Trilium App if a victim searches for specific keywords