pentester.land· Jul 10, 2024· by Patrick Peng (@retr0reg)

Evernote RCE: From PDF.js font-injection to All-platform Electron exposed ipcRenderer with listened BrokerBridge Remote-Code Execution

Open Original Article ↗
Target Program: Evernote
🎯 Vulnerability: Remote Code Execution (RCE)
💡 Defense Fix: Avoid executing shell commands via system(). Use parameterized APIs and strict input sanitization.
#RCE#XSS#Electron#Thick client