Remote Code Execution in Koodo Reader via Malicious EPUB

Executive Summary

Koodo Reader, an ebook reader application, has a vulnerability in version 2.3.0 and earlier that allows remote code execution. This happens because the application enables nodeIntegrationInSubFrames in its open-book IPC handler and renders EPUB chapter content using unsanitized innerHTML. An attacker can create a malicious EPUB file that, when opened by a user, loads a hidden iframe with access to Node.js APIs, allowing the attacker to execute arbitrary operating system commands with the user's privileges.

This vulnerability is fixed in version 2.3.1 of Koodo Reader.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability occurs when a user opens a malicious EPUB file in Koodo Reader versions before 2.3.1, which enables Node.js integration in sub-frames and renders unsanitized HTML content. Detection involves identifying if vulnerable versions of Koodo Reader are installed and monitoring for suspicious EPUB files being opened.

To detect the vulnerability on your system, first check the installed version of Koodo Reader. If it is version 2.3.0 or earlier, the system is vulnerable.

• On Linux/macOS, run: `koodo-reader --version` or check the application version via your package manager.
• On Windows, check the application version in the About section or via PowerShell: `Get-Item 'C:\Path\To\KoodoReader.exe' | Select-Object VersionInfo`.

To detect exploitation attempts, monitor for suspicious activity such as unexpected execution of system commands triggered by opening EPUB files. Since the attack can execute OS commands, you can look for unusual process creation events or command executions originating from Koodo Reader.

• On Windows, use PowerShell to monitor process creation events: `Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational';ID=1} | Where-Object { $_.Message -like '*koodo-reader*' }`.
• On Linux, use auditd or process accounting to track commands executed by the Koodo Reader process.

Additionally, scanning EPUB files before opening them for embedded iframes or suspicious JavaScript could help, but no specific commands for this are provided.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to execute arbitrary operating system commands on your device with the same privileges as the user running Koodo Reader. This could lead to unauthorized access, data theft, installation of malware, or other malicious activities on your system.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate step to mitigate this vulnerability is to upgrade Koodo Reader to version 2.3.1 or later, where the issue is fixed.

Avoid importing or opening EPUB files from untrusted or unknown sources, as malicious EPUB files can exploit this vulnerability.

Useful 0 Not Useful 0