CVE-2022-40011
📋 TL;DR
Typora markdown editor versions through 1.3.8 contain a cross-site scripting (XSS) vulnerability when exporting documents containing malicious SVG elements. Attackers can craft documents that execute arbitrary JavaScript in the victim's browser context when exported and viewed. This affects all Typora users who open untrusted documents and export them.
💻 Affected Systems
- Typora
📦 What is this software?
Typora by Typora
⚠️ Risk & Real-World Impact
Worst Case
Full compromise of user's browser session, allowing theft of authentication cookies, session hijacking, and execution of arbitrary actions within the user's Typora environment.
Likely Case
Limited data theft from the user's browser session, potential for credential harvesting if user is logged into web services while viewing the document.
If Mitigated
No impact if users only open trusted documents or have disabled JavaScript execution in their browser.
🎯 Exploit Status
Proof of concept available in public GitHub gist. Exploitation requires social engineering to get victim to open malicious document.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.4.0 and later
Vendor Advisory: https://typora.io/releases/all
Restart Required: Yes
Instructions:
1. Open Typora. 2. Go to Help > Check for Updates. 3. Download and install version 1.4.0 or later. 4. Restart Typora.
🔧 Temporary Workarounds
Disable SVG rendering
allPrevent Typora from rendering SVG elements which could contain malicious payloads
Not applicable - configuration setting
Use sandboxed environment
allRun Typora in a sandboxed or isolated environment to limit impact of potential XSS
🧯 If You Can't Patch
- Only open documents from trusted sources and avoid exporting untrusted documents
- Use browser extensions that block JavaScript execution in local HTML files
🔍 How to Verify
Check if Vulnerable:
Check Typora version in Help > About. If version is 1.3.8 or earlier, system is vulnerable.Check Version:
On Typora: Help > About. On command line: typora --version (if installed via package manager)Verify Fix Applied:
Verify Typora version is 1.4.0 or later in Help > About.📡 Detection & Monitoring
Log Indicators:
- Unusual document export activity
- Multiple failed export attempts
Network Indicators:
- Outbound connections from Typora to unexpected domains after document export
SIEM Query:
process.name:"Typora.exe" AND event.action:"export" AND file.extension:"html" OR file.extension:"pdf"