Proton v0.2.0 allows an attacker to create a malicious link inside a markdown file. When the victim clicks the link, the application opens the site in the current frame allowing an attacker to host JavaScript code in the malicious link in order to trigger an XSS attack. The 'nodeIntegration' configuration is set to on which allows the 'webpage' to use 'NodeJs' features, an attacker can leverage this to run OS commands.
Metrics
Affected Vendors & Products
References
Link | Providers |
---|---|
https://fluidattacks.com/advisories/lennon/ |
History
No history.
MITRE
Status: PUBLISHED
Assigner: Fluid Attacks
Published: 2022-05-20T11:04:12
Updated: 2024-08-03T04:36:06.522Z
Reserved: 2022-02-15T00:00:00
Link: CVE-2022-25224
Vulnrichment
No data.
NVD
Status : Modified
Published: 2022-05-20T12:15:10.883
Modified: 2024-11-21T06:51:50.187
Link: CVE-2022-25224
Redhat
No data.