Linux marketplaces vulnerable to RCE and supply chain attacks

-- MARKDOWN -- - [KDE Discover](#kde-discover) - [Wormable XSS affecting multiple marketplaces](#wormable-xss-affecting-multiple-marketplaces) - [PlingStore RCE](#plingstore-rce)     - [RCE by design](#rce-by-design)     - [Exploitation from any browser](#exploitation-from-any-browser)     - [Disclosure](#disclosure) - [Gnome Shell Extensions XSS](#gnome-shell-extensions-xss) - [Conclusion](#conclusion) # KDE Discover

In the beginning of this year, we analyzed how popular desktop applications handle user supplied URIs [and found code execution vulnerabilities in several of them](https://positive.security/blog/url-open-rce). One of the applications I checked was the *KDE Discover* App Store, which did turn out to handle untrusted URIs in an insecure manner (CVE-2021-28117, [KDE Security Advisory](https://kde.org/info/security/advisory-20210310-1.txt)).

A wormable XSS with potential for supply chain attacks on *Pling*-based marketplaces, and a drive-by RCE affecting users of the *PlingStore* application are still exploitable as of 2021-06-22.

Leave a Comment