Description
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, Joplin accepts synchronized resource metadata whose id or file_extension contains parent-directory or path-separator characters. BaseItem.unserialize() stores the unvalidated fields, resourceFilename() concatenates them into a destination path, and ResourceFetcher writes the attacker-controlled resource blob outside the resource directory during background synchronization. An attacker with write access to a configured sync target or shared notebook can create or overwrite files at an attacker-chosen existing path without user interaction. This issue is fixed in versions 3.6.15 and 3.7.2.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
laurent22 joplin
< 3.6.15affected>= 3.7.0, < 3.7.2affected
References
- https://github.com/laurent22/joplin/security/advisories/GHSA-r24r-gp6h-cwgf ↗
- https://github.com/laurent22/joplin/pull/15540 ↗
- https://github.com/laurent22/joplin/pull/15672 ↗
- https://github.com/laurent22/joplin/commit/18e0b08c282c89ae51612c4eff67af2a45ff5163 ↗
- https://github.com/laurent22/joplin/commit/50518073740c4501058e366300b42c2f1925cb05 ↗