CVE-2024-39904 Code Execution Vulnerability via Local File Path Traversal in Vnote
Attackers can execute arbitrary code on victim systems by embedding malicious file URIs in shared notes, requiring users to open the crafted note.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-39904?
CVE-2024-39904 is a high-severity path traversal vulnerability in vnotex vnote, published on 11 Jul 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
VNote is a note-taking platform. Prior to 3.18.1, a code execution vulnerability existed in VNote, which allowed an attacker to execute arbitrary programs on the victim's system. A crafted URI can be used in a note to perform this attack using file:/// as a link. For example, file:///C:/WINDOWS/system32/cmd.exe. This allows attackers to execute arbitrary programs by embedding a reference to a local executable file such as file:///C:/WINDOWS/system32/cmd.exe and file:///C:/WINDOWS/system32/calc.exe. This vulnerability can be exploited by creating and sharing specially crafted notes. An attacker could send a crafted note file and perform further attacks. This vulnerability is fixed in 3.18.1.
Weakness: CWE-73
Which versions are affected by CVE-2024-39904?
How do I fix CVE-2024-39904?
No fix has been published for CVE-2024-39904 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-39904 being exploited?
There is no known exploitation of CVE-2024-39904 in the wild and no public exploit code.
Sources
Also known as GHSA-vhh5-8wcv-68gj.