CVE-2022-25224

Proton v0.2.0 allows an attacker to create a malicious link inside a markdown file. When the victim clicks the link, the application opens the site in the current frame allowing an attacker to host JavaScript code in the malicious link in order to trigger an XSS attack. The 'nodeIntegration' configuration is set to on which allows the 'webpage' to use 'NodeJs' features, an attacker can leverage this to run OS commands.

CVSS v3 5.4 MEDIUM
CVSS v2.0 3.5 LOW

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://fluidattacks.com/advisories/lennon/	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:proton_project:proton:0.2.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-05-20 12:15

Updated : 2022-05-31 15:33

NVD link : CVE-2022-25224

Mitre link : CVE-2022-25224

CVE.ORG link : CVE-2022-25224

JSON object : View

Products Affected

proton_project

proton

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2022-25224", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2022-05-20T12:15:10.883", "references": [{"url": "https://fluidattacks.com/advisories/lennon/", "tags": ["Exploit", "Third Party Advisory"], "source": "help@fluidattacks.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Proton v0.2.0 allows an attacker to create a malicious link inside a markdown file. When the victim clicks the link, the application opens the site in the current frame allowing an attacker to host JavaScript code in the malicious link in order to trigger an XSS attack. The 'nodeIntegration' configuration is set to on which allows the 'webpage' to use 'NodeJs' features, an attacker can leverage this to run OS commands."}, {"lang": "es", "value": "Proton versi\u00f3n v0.2.0, permite a un atacante crear un enlace malicioso dentro de un archivo markdown. Cuando la v\u00edctima hace clic en el enlace, la aplicaci\u00f3n abre el sitio en el marco actual permitiendo a un atacante alojar c\u00f3digo JavaScript en el enlace malicioso para desencadenar un ataque de tipo XSS. La configuraci\u00f3n \"nodeIntegration\" est\u00e1 habilitada, lo que permite a la p\u00e1gina web usar las caracter\u00edsticas de \"NodeJs\", un atacante puede aprovechar esto para ejecutar comandos del Sistema Operativo"}], "lastModified": "2022-05-31T15:33:01.343", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:proton_project:proton:0.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9AF0DFCA-0F88-437E-8E07-F223ED15C4B8"}], "operator": "OR"}]}], "sourceIdentifier": "help@fluidattacks.com"}