CVE-2024-7739
📋 TL;DR
This vulnerability in the yzane vscode-markdown-pdf extension allows cross-site scripting (XSS) attacks when processing malicious markdown files. Attackers can inject and execute arbitrary JavaScript code in the context of the victim's browser. Users of the Visual Studio Code markdown-pdf extension version 1.5.0 are affected.
💻 Affected Systems
- yzane vscode-markdown-pdf
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of user session, credential theft, or installation of malware through malicious JavaScript execution in the victim's browser context.
Likely Case
Session hijacking, cookie theft, or defacement of generated PDF content through injected scripts.
If Mitigated
Limited impact with proper content security policies and input validation, potentially only affecting PDF rendering quality.
🎯 Exploit Status
Proof of concept video and documentation are publicly available, making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Remove or disable the extension until a fix is released.
🔧 Temporary Workarounds
Disable or Remove Extension
allUninstall the vulnerable markdown-pdf extension from Visual Studio Code
code --uninstall-extension yzane.markdown-pdf
Use Alternative PDF Export
allUse alternative markdown to PDF conversion tools instead of the vulnerable extension
🧯 If You Can't Patch
- Restrict opening untrusted markdown files in Visual Studio Code
- Implement strict content security policies in browser when viewing generated PDFs
🔍 How to Verify
Check if Vulnerable:
Check Visual Studio Code extensions list for 'markdown-pdf' by yzane version 1.5.0Check Version:
code --list-extensions --show-versions | grep markdown-pdfVerify Fix Applied:
Verify extension is removed or disabled in Visual Studio Code extensions panel📡 Detection & Monitoring
Log Indicators:
- Unusual JavaScript execution in PDF generation processes
- Suspicious markdown file processing
Network Indicators:
- External script loading in generated PDF files
- Unexpected outbound connections from PDF viewer
SIEM Query:
process_name:"code" AND cmdline:"markdown-pdf" AND file_path:"*.md"🔗 References
- https://github.com/abhi-ingle/Vulnerability-Research/blob/main/POC/Script%20Injection/poc_script_inject.mp4
- https://github.com/abhi-ingle/Vulnerability-Research/blob/main/POC/Script%20Injection/script_injection_report.md
- https://vuldb.com/?ctiid.274359
- https://vuldb.com/?id.274359
- https://vuldb.com/?submit.385635
