Researcher Finds Vulnerability Impacting Multiple Linux Marketplaces

guest · Jun 27, 2021

You won't want that Linux bling if it comes from Pling: Marketplace platform has critical vulnerabilities
No one wants to be pwned by a drive-by RCE
June 24, 2021
https://www.theregister.com/2021/06/24/pling_linux_flaws/

A Berlin startup has disclosed a remote-code-execution (RCE) vulnerability and a wormable cross-site-scripting (XSS) flaw in Pling, which is used by various Linux desktop theme marketplaces.

Positive Security, which found the holes and is not to be confused with Russia’s Positive Technologies, said the bugs are still present in the Pling code and its maintainers have not responded to vulnerability reports.
Click to expand...

Pling presents itself as a marketplace for creative folk to upload Linux desktop themes and graphics, among other things, in the hope of making a few quid from supporters. It comes in two parts: code needed to run your own bling bazaar, and an Electron-based app users can install to manage their themes from a Pling souk. The web code has the XSS in it, and the client has the XSS and an RCE. Pling powers a bunch of sites, from pling.com and store.kde.org to gnome-look.org and xfce-look.org.
Click to expand...

The upshot is that miscreants can exploit the XSS to upload and modify resources as other users on marketplaces, and the RCE can be abused by webpages and marketplaces to execute malicious code on a victim's computer.

“A wormable XSS with potential for supply chain attacks on Pling-based marketplaces, and a drive-by RCE affecting users of the PlingStore application are still exploitable,” wrote Positive’s Fabian Bräunlein on Tuesday.
Pling’s anonymous maintainers, who do not identify themselves on either Pling.com or sister site opendesktop.org, did not respond to an email seeking comment.
Click to expand...

Positive Security: Linux marketplaces vulnerable to RCE and supply chain attacks

Linux marketplaces that are based on the Pling platform are vulnerable to a wormable XSS with potential for a supply chain attack

The native PlingStore application is affected by an RCE vulnerability, which can be triggered from any website while the app is running

The Pling team could not be reached, which is why we have decided to publish these unpatched vulnerabilities in order to warn users

The KDE Discover and Gnome Shell Extension teams quickly fixed other lower-severity vulnerabilities reported to them

Click to expand...

Log in or Sign up

Researcher Finds Vulnerability Impacting Multiple Linux Marketplaces

guest Guest

Log in or Sign up

Researcher Finds Vulnerability Impacting Multiple Linux Marketplaces

guest Guest

Useful Searches