Attack Chain

1. An attacker crafts a malicious TiddlyWiki repository containing a .tid file with module-type: startup and JavaScript code in the exports.startup function (e.g., require('child_process').execSync('calc');).
2. The victim is enticed to import the malicious repository into TidGi Desktop, typically by clicking "Add Workspace" and selecting the attacker-controlled Git repository or local folder.
3. TidGi Desktop initiates the wiki boot sequence, which involves $tw.boot.startup().
4. During loadStartup(), the loadTiddlersNode() function reads all .tid files from the filesystem, including the attacker's malicious file, and adds them to the wiki store via wiki.addTiddlers().
5. Subsequently, execStartup() calls defineTiddlerModules(), which iterates through all tiddlers in the store. The attacker's tiddler, having module-type: startup, is registered as an executable module.
6. The boot sequence proceeds to forEachModuleOfType("startup", ...), collecting all registered "startup" modules, including the attacker's.
7. Finally, executeNextStartupTask() calls the exports.startup() function of the collected modules without platform restrictions, leading to the execution of the attacker's JavaScript code with full Node.js privileges.
8. Arbitrary commands, such as launching calc.exe or creating files, are executed on the victim's operating system.

Impact

Successful exploitation of this vulnerability leads to critical consequences, including full Node.js access for the attacker, enabling remote code execution on the victim's machine. Attackers can leverage this access to perform arbitrary file reads and writes, establish reverse shells using Node.js's net module, and establish persistence by writing to startup scripts or other system mechanisms. The vulnerability affects Windows, macOS, and Linux systems and requires only a single user interaction (importing the repository). Given that TidGi Desktop is a personal knowledge base and note-taking application, a compromise could lead to significant data exfiltration, system damage, or further lateral movement within an affected environment.

Recommendation

• Enable comprehensive process_creation logging across all endpoints running TidGi Desktop to detect unusual child processes spawned by Node.js or TidGi-Desktop, leveraging the Sigma rule provided in this brief.
• Monitor file_event logs for suspicious file creations, especially in temporary directories (/tmp on Linux/macOS, %TEMP% on Windows), originating from the TidGi-Desktop process or its child processes.
• Educate users about the risks of importing untrusted repositories or files into applications like TidGi Desktop.
• Implement application whitelisting solutions to restrict execution of unknown or untrusted executables, particularly those launched as child processes by applications like TidGi Desktop.