CVE-2023-31874

Vulnerability

Yank Note (YN) version 3.52.1 contains a code execution vulnerability that triggers when a user opens a crafted file. The issue arises from the application's use of nodeRequire('child_process') within the editor, which processes arbitrary JavaScript from the document content without proper sanitization [1]. This allows an attacker to embed malicious code that executes in the context of the Yank Note application.

Exploitation

To exploit this vulnerability, an attacker needs to craft a file containing a malicious payload that uses nodeRequire('child_process') to execute system commands. The attacker then must convince a victim to open the crafted file in Yank Note 3.52.1. No special network position or authentication is required beyond standard file access [1]. The exploitation occurs immediately upon file open, as Yank Note processes the embedded code without user interaction beyond opening the file.

Impact

Successful exploitation allows an attacker to execute arbitrary code on the victim's system with the privileges of the Yank Note process. This can lead to full compromise of the host, including data exfiltration, installation of malware, or further lateral movement within the network. The impact is complete loss of confidentiality, integrity, and availability [1].

Mitigation

As of May 2023, a fixed version has not been disclosed in the available references. Users should avoid opening untrusted files in Yank Note 3.52.1 and monitor for updates from the vendor. No workaround has been published [1].