A Berlin-based startup has revealed a remote code execution (RCE) vulnerability and a cross-site scripting (XSS) flaw in Pling, which is used by several application catalogs built on this platform. This vulnerability could allow JavaScript code to be executed in the context of other users. Affected sites include some of the leading open-source application catalogs, such as store.kde.org, appimagehub.com, gnome-look.org, xfce-look.org, and pling.com, among others.
Positive Security, which found the holes, said that the bugs are still present in the Pling code and that its maintainers have not responded to the vulnerability reports.
Earlier this year, we looked at how popular desktop apps handle user-supplied URIs and found code execution vulnerabilities in several of them. One of the apps I checked was the KDE Discover App Store, which turned out to handle untrusted URIs in an insecure way (CVE-2021-28117, KDE Security Advisory).
Along the way, I quickly found several more serious vulnerabilities in other free software markets.
A wormed XSS with the potential for supply chain attacks in Pling-based markets and a drive-by RCE affecting PlingStore application users can still be exploited.
Pling presents itself as a marketplace for creatives to upload Linux desktop themes and graphics, among other things, hoping to earn some money from supporters. It comes in two parts: the code needed to run your own bling bazaar and an Electron-based application that users can install to manage their themes from a Pling marketplace. The web code contains the XSS vulnerability, while the client contains both the XSS and a RCE vulnerability. Pling powers several sites, from pling.com and store.kde.org to gnome-look.org and xfce-look.org.
The core of the problem is that the Pling platform allows the addition of multimedia blocks in HTML format, for example, to embed a YouTube video or an image. The code added through the form is not properly validated, allowing malicious code to be added disguised as an image and to place information in the directory that will execute JavaScript code when viewed. If this information is accessible to users with an account, then it's possible to initiate actions in the directory on behalf of that user, including adding a JavaScript call to their pages, effectively implementing a kind of network worm.
Furthermore , a vulnerability has been identified in the PlingStore application, written using the Electron platform, which allows it to navigate through OpenDesktop directories without a browser and install packages found there. This vulnerability in PlingStore allows its code to execute on the user's system.
When the PlingStore application is running, the ocs-manager process is also started, accepting local connections via WebSocket and executing commands such as loading and launching applications in AppImage format . These commands are supposed to be transmitted by the PlingStore application, but in fact, due to the lack of authentication, a request to ocs-manager can be sent from the user's browser. If a user opens a malicious website, it can initiate a connection with ocs-manager and cause code to execute on the user's system.
An XSS vulnerability has also been reported in the extensions.gnome.org directory; in the field with the URL of the plugin's home page, you can specify JavaScript code in the format "javascript:code" and when you click on the link, the specified JavaScript will be launched instead of opening the project site.
On one hand, the problem is more speculative , since the moderation involves the location in the extensions.gnome.org directory, and the attack requires not only opening a specific page but also explicitly clicking the link. On the other hand, it's possible that during the verification process, the moderator might want to go to the project's website, bypass the link form, and execute the JavaScript code within the context of their account.
Finally, if you are interested in learning more, you can find the details at the following link.