Joplin DOM Clobbering Vulnerability Leading to Denial-of-Service

A DOM clobbering vulnerability has been identified in Joplin, a note-taking and to-do application. This vulnerability allows the 'name' attribute to be set in a way that overwrites existing document properties, such as 'querySelector'. The only known impact of this vulnerability is a denial-of-service condition, where the note viewer fails to refresh until the note is closed and reopened. This issue affects Joplin versions 3.2.3 and prior.

Impact

Exploitation of this vulnerability causes a temporary denial-of-service condition in the note viewer, which fails to refresh until the note is closed and reopened with a different one.

Reproduction

To reproduce this vulnerability, create a note containing an image tag with the 'name' attribute set to 'getElementById' and the 'src' attribute pointing to a valid image URL. After saving the note, attempt to switch to another note. The original note's content will still be visible, and the console will display an error indicating that 'document.getElementById' is not a function, demonstrating that the 'name' attribute has clobbered the DOM method.

Remediation

Users are advised to upgrade to Joplin version 3.2.8 or later, where this vulnerability has been addressed.