XSS in Siyuan Electron App when rendering mermaid block diagram Leading to RCE(Just Thanks)
Summary
Due to outdated mermaid 10.8.0 is used to render block diagrams, a XSS in block diagram is able to trigger, chained with insecure configuration of windows electron app, attacker is able to execute code in victims local system.
Details
Siyuan is using mermaid 10.8.0 to render mermaid diagram. However, the test html in mermaid repo showed that the edge label names of new block diagram is not sanitized and could lead to XSS. The name of node is not fully sanitized which leads to injection of XSS payload.
Besides, the electron app sets nodeIntegration to true which is harmful, according to this attack, a XSS can be escalated to execute command on victims’ local system.
PoC
-
Download latest Siyuan-3.0.17 windows electron app from official site, and install the application:
- Create new document, and type
/Mermaidcommand to insert mermaid diagram using following payload:block-beta `A-- "X<img src=x onerror=require('child_process').exec('calc');>" -->B -
The calculator poped up.
Impact
Client side code execution.
Reference
https://github.com/siyuan-note/siyuan/issues/11645