CVE-2024-39904: Insufficient Information (NVD-CWE-noinfo)
value: VNote is a note-taking platform. Prior to 3.18.1, a code execution vulnerability existed in VNote, which allowed an attacker to execute arbitrary programs on the victim's system. A crafted URI can be used in a note to perform this attack using file:/// as a link. For example, file:///C:/WINDOWS/system32/cmd.exe. This allows attackers to execute arbitrary programs by embedding a reference to a local executable file such as file:///C:/WINDOWS/system32/cmd.exe and file:///C:/WINDOWS/system32/calc.exe. This vulnerability can be exploited by creating and sharing specially crafted notes. An attacker could send a crafted note file and perform further attacks. This vulnerability is fixed in 3.18.1.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-07-11T16:15Z
Repository: https://github.com/vnotex/vnote
Language: C++
Files changed: src/utils/widgetutils.cpp
Commit date: 2024-07-07 22:51:07 +0800
Commit message: check link before open

Diff: diff --git a/src/utils/widgetutils.cpp b/src/utils/widgetutils.cpp
index b9974b1e..e88a7e6b 100644
--- a/src/utils/widgetutils.cpp
+++ b/src/utils/widgetutils.cpp
@@ -25,10 +25,12 @@
 #include <QPushButton>
 #include <QSplitter>
 #include <QFormLayout>
 
 #include <core/global.h>
+#include <widgets/messageboxhelper.h>
+#include <widgets/mainwindow.h>
 
 using namespace vnotex;
 
 void WidgetUtils::setPropertyDynamically(QWidget *p_widget,
                                          const char *p_prop,
@@ -73,10 +75,23 @@ QSize WidgetUtils::availableScreenSize(QWidget *p_widget)
     return p_widget->screen()->availableGeometry().size();
 }
 
 void WidgetUtils::openUrlByDesktop(const QUrl &p_url)
 {
+    const auto scheme = p_url.scheme();
+    if (scheme != "http" && scheme != "https") {
+        // Prompt for user.
+        int ret = MessageBoxHelper::questionYesNo(MessageBoxHelper::Warning,
+                                                  MainWindow::tr("Are you sure to open link (%1)?").arg(p_url.toString()),
+                                                  MainWindow::tr("Malicious link might do harm to your device."),
+                                                  QString(),
+                                                  nullptr);
+        if (ret == QMessageBox::No) {
+            return;
+        }
+    }
+
     QDesktopServices::openUrl(p_url);
 }
 
 bool WidgetUtils::processKeyEventLikeVi(QWidget *p_widget,
                                         QKeyEvent *p_event,

Fixed code: #include <widgets/messageboxhelper.h>
#include <widgets/mainwindow.h>
    const auto scheme = p_url.scheme();
    if (scheme != "http" && scheme != "https") {
        // Prompt for user.
        int ret = MessageBoxHelper::questionYesNo(MessageBoxHelper::Warning,
                                                  MainWindow::tr("Are you sure to open link (%1)?").arg(p_url.toString()),
                                                  MainWindow::tr("Malicious link might do harm to your device."),
                                                  QString(),
                                                  nullptr);
        if (ret == QMessageBox::No) {
            return;
        }
    }