Zepl Notebook suffers from a remote code execution vulnerability.
9d603c1863096f6609b45bc48296b1f4Exploit Title: Zepl Notebook - Remote Code Execution
Date: 9/28/2021
Vendor Homepage: https://zepl.com/
Software Link: https://app.zepl.com/
Version: All previous versions of product to the date of this submission
Tested on: The issue affects all versions of the product up to the date of this submission
Exploit Authors: Josh Sheppard & Pathfynder Inc
Exploit Contact: ghost a t undervurse dot_com & josh a t pathfynder dot_io
Exploit Technique: Remote
CVE ID: CVE-2021-42950
1. Description
A remote code execution vulnerability has been discovered in Zepl's Notebooks product. Users can register for an account and are allocated a set number of credits to try the product. Once users authenticate, they can proceed to create a new organization by which additional users can be added for various collaboration abilities. Once this has been established, users can then create new Zepl Notebooks with various languages, contexts and deployment scenarios. Upon creating a new notebook with specially crafted malicious code, a user can then launch remote code execution.
This vulnerability effects all previous versions of their Notebook product suite.
2. Disclosure Timeline
9/28/21 - Discovery and Exploitation
9/28/21 - Vendor Notified
2/16/22 - CVE Assignment
2/17/22 - Public Disclosure
3. Mitigation
Hotfix applied to vendors SAAS solution, no action is necessary at this time.