A remote code execution vulnerability exists in the client

[HongLuDianXue]

When using nw.js, the security of the code is not verified, so that the exec() in child_process can be called to execute malicious code.

For example, add the following content in the md file:

<a href="javascript:alert('Hello~')">Test</a>

Click Test in the preview on the right to execute JavaScript pop-up code, which is XSS vulnerability (Cross Site Scripting).

Run the local calc.exe code through the exec() function in the "child_process" module:

<a href="javascript:eval(atob('dmFyIGF0dCA9IHJlcXVpcmUoJ2NoaWxkX3Byb2Nlc3MnKTsKYXR0LmV4ZWMoImNhbGMuZXhlIiwgZnVuY3Rpb24oZXJyb3IsIHN0ZG91dCwgc3RkZXJyKSB7fSk7'))">Test</a>

Click Test in the preview on the right, and the local calc.exe program is executed.

I uploaded a demo video of using this vulnerability to attack here:

https://hldx.cowtransfer.com/s/c0b8ee3aa37b48

In the demo video, after the user clicks AttTest (it looks like a hyperlink) in the Qilin Editor, the computer will execute malicious code and be controlled by the attacker (the whoami command is executed in the demo video and the A new text file with the content test is created under the C:\ directory), and the user has no knowledge of this.