Stored XSS Vulnerability in EdgeEver setMemoDragPreview

EdgeEver versions 1.112.0 and earlier are affected by a stored cross-site scripting (XSS) vulnerability located in the setMemoDragPreview function. This vulnerability allows an authenticated attacker to inject arbitrary JavaScript into the application by creating or renaming notebook names and memo titles. The malicious script is stored by the application and subsequently executed when a user initiates a drag-and-drop action on the affected element. Due to the architecture of the application, the execution context includes access to the desktop bridge session token, which could be exfiltrated by an attacker to facilitate session hijacking.

Impact

Successful exploitation allows for the execution of arbitrary code within the context of the user's session. This poses a significant risk of session token theft, potentially leading to full account compromise. Users of the EdgeEver desktop application across Windows, macOS, and Linux are susceptible if they interact with malicious notebooks or memos created or renamed by an attacker.

Recommendation

• Upgrade the EdgeEver desktop application to a version greater than 1.112.0 immediately once a vendor patch is released.
• Implement content security policies (CSP) at the application level to restrict the execution of untrusted scripts.
• Monitor logs for the use of notebook creation or renaming tools that contain non-standard or script-like character patterns in their titles or names.