Vulnerability DatabaseCVE-2023-2316

CVE-2023-2316:
Typora vulnerability analysis and mitigation

Overview

Typora, a popular cross-platform markdown editor, was found to contain a Local File Disclosure vulnerability (CVE-2023-2316) affecting versions before 1.6.7 on Windows and Linux platforms. The vulnerability was discovered on April 27, 2023, and patched on May 22, 2023. The issue stems from improper path handling in the 'typora://app/' protocol, which allows malicious webpages to access local files and potentially exfiltrate them to remote web servers (STAR Labs).

Technical details

The vulnerability exists in the custom URL scheme 'typora://' implementation within resources/app.asar/atom.js, registered via electron.protocol.registerFileProtocol API. The flaw allows external webpages loaded in HTML tags to read arbitrary local files through JavaScript code execution. The vulnerability has been assigned a CVSS3.1 Base Score of 6.3 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N, indicating local attack vector, low attack complexity, no privileges required, and user interaction required (STAR Labs).

Impact

When successfully exploited, the vulnerability allows attackers to access and read arbitrary local files from the victim's system. The attacker can then exfiltrate these files to remote web servers, potentially exposing sensitive information. The vulnerability affects the confidentiality of data while integrity and availability remain uncompromised (STAR Labs).

Mitigation and workarounds

The vulnerability has been patched in Typora version 1.6.7. Users are advised to update to this version or later. For users on affected versions, it is recommended to avoid opening untrusted markdown files in Typora and refrain from copying text from untrusted webpages into Typora. The vendor has implemented measures to prohibit HTTP(S) webpages from accessing typora:// resources (STAR Labs, Typora Support).