Summary
We discovered a one-click Remote Code Execution (RCE) vulnerability in Muffon v2.2.0. An attacker can exploit this issue by embedding a specially crafted muffon:// link on any website they control. When a victim visits the site or clicks the link, the browser triggers Muffon’s custom URL handler, causing the application to launch and process the URL. This leads to RCE on the victim's machine without further interaction.
Details
Multiple XSSes
Muffon uses the Vue directive v-html to render untrusted input in several components. According to Vue’s security recommendations, v-html should only be used on sanitized content. Otherwise, it introduces XSS vulnerabilities. In contrast, v-text is the safer alternative for untrusted values.
XSS in Search History
XSS in the Playlist Editor
These two are self-XSS since they require direct user input and interaction, making them not very practical for exploitation in real-world attacks.
XSS in the Artist Page
A more severe issue exists in the artist page. Muffon retrieves artist data from third-party sources like Bandcamp and injects it into the DOM without sanitization. We exploited this by registering a Bandcamp artist using the name: <img src=1 onerror=alert('band-tt-13337')>. In this case, when the user visit my artist page, it would directly get XSSed.
When a user visits the corresponding artist page within Muffon, the payload is rendered and executed immediately.
Although this is a stored XSS, discovering the malicious page randomly is unlikely. However, when combined with the next issue, it becomes a powerful attack vector.
Custom Link Handling
Muffon registers a custom URL scheme (muffon://) that supports deep linking into internal pages. This allows an attacker to embed a crafted link on a website. Once a victim visits the site, the browser launches Muffon and loads the target internal page without even exposing the URL contents to the user.
This enables automatic navigation to an XSS payload without any further interaction from the user.
From XSS to RCE
The vulnerable renderer has access to privileged APIs such as openExternalLink from the preload script, which will be handled by Electron’s shell.openExternal in the main process. This API can be abused to execute arbitrary files on the victim’s machine.
mainProcess.openExternalLink('file:///tmp/calc')PoC
Video PoC can be found at: https://drive.google.com/file/d/1eCPCQ6leuVM_vecfofFv04c0t9isCBqR/view?usp=sharing
Steps to reproduce:
- Open the browser and navigate to the following link:
muffon://artists/%3Cimg%20src%3D1%20onerror%3DmainProcess.openExternalLink('file%3A%2F%2F%2Ftmp%2Fcalc')%3E/tracks/noscript-7331?source=bandcamp&track_id=3502361426&artist_id=2528590395
- Muffon will launch and immediately execute the payload. If
/tmp/calc is an executable (e.g., Calculator), it will be launched.
Impact
This is a one-click Remote Code Execution vulnerability triggered by simply visiting a webpage. The attack works just like a typical reflected or DOM-based XSS, however, it leads to a much more severe consequence by allowing code execution on the victim’s machine.
Credits
Zhengyu Liu (jackfromeast), Jianjia Yu (suuuuuzy)
jackfromeast Reporter
Suuuuuzy Reporter
staniel359 Remediation developer
xyloflake Remediation reviewer
gamersi Remediation verifier
Summary
We discovered a one-click Remote Code Execution (RCE) vulnerability in Muffon v2.2.0. An attacker can exploit this issue by embedding a specially crafted
muffon://link on any website they control. When a victim visits the site or clicks the link, the browser triggers Muffon’s custom URL handler, causing the application to launch and process the URL. This leads to RCE on the victim's machine without further interaction.Details
Multiple XSSes
Muffon uses the Vue directive
v-htmlto render untrusted input in several components. According to Vue’s security recommendations,v-htmlshould only be used on sanitized content. Otherwise, it introduces XSS vulnerabilities. In contrast,v-textis the safer alternative for untrusted values.XSS in Search History
XSS in the Playlist Editor
These two are self-XSS since they require direct user input and interaction, making them not very practical for exploitation in real-world attacks.
XSS in the Artist Page
A more severe issue exists in the artist page. Muffon retrieves artist data from third-party sources like Bandcamp and injects it into the DOM without sanitization. We exploited this by registering a Bandcamp artist using the name:
<img src=1 onerror=alert('band-tt-13337')>. In this case, when the user visit my artist page, it would directly get XSSed.When a user visits the corresponding artist page within Muffon, the payload is rendered and executed immediately.
Although this is a stored XSS, discovering the malicious page randomly is unlikely. However, when combined with the next issue, it becomes a powerful attack vector.
Custom Link Handling
Muffon registers a custom URL scheme (
muffon://) that supports deep linking into internal pages. This allows an attacker to embed a crafted link on a website. Once a victim visits the site, the browser launches Muffon and loads the target internal page without even exposing the URL contents to the user.This enables automatic navigation to an XSS payload without any further interaction from the user.
From XSS to RCE
The vulnerable renderer has access to privileged APIs such as
openExternalLinkfrom the preload script, which will be handled by Electron’sshell.openExternalin the main process. This API can be abused to execute arbitrary files on the victim’s machine.PoC
Video PoC can be found at: https://drive.google.com/file/d/1eCPCQ6leuVM_vecfofFv04c0t9isCBqR/view?usp=sharing
Steps to reproduce:
muffon://artists/%3Cimg%20src%3D1%20onerror%3DmainProcess.openExternalLink('file%3A%2F%2F%2Ftmp%2Fcalc')%3E/tracks/noscript-7331?source=bandcamp&track_id=3502361426&artist_id=2528590395/tmp/calcis an executable (e.g., Calculator), it will be launched.Impact
This is a one-click Remote Code Execution vulnerability triggered by simply visiting a webpage. The attack works just like a typical reflected or DOM-based XSS, however, it leads to a much more severe consequence by allowing code execution on the victim’s machine.
Credits
Zhengyu Liu (jackfromeast), Jianjia Yu (suuuuuzy)