Summary
Joplin Server can serve an attacker-controlled attachment type without a download disposition when the resource has an empty title, allowing script-capable content to execute in a victim's browser. A low-privileged user may abuse this behavior through a public share, potentially accessing same-origin data or performing actions through an authenticated victim's session.
Affected context
The issue occurs in Joplin Server public-share resource delivery when:
- A user with low privileges can publish an attachment through a share
- The attachment uses a script-capable media type such as image/svg+xml
- The resource title is empty, causing the response to omit Content-Disposition
- User content is served from the application origin or another browser-accessible origin
Deployments using a separate USER_CONTENT_BASE_URL can reduce exposure to application-origin data, but script execution on the configured content origin may still occur.
Exploit preconditions
- Attack surface: Public share resource retrieval through the Joplin Server HTTP interface
- Required access: Low-privileged ability to publish or control shared attachment content
- Trigger point: A victim opens the public share containing the crafted resource
- Why exploitation is possible: The server reflects an attacker-controlled MIME value and may render the resource inline without a download disposition, allowing browser script execution
- Additional condition: Impact is greater when the content is served from the same origin as the authenticated Joplin application
Why this happens
The vulnerability is caused by insufficient output handling for user-controlled resource metadata. Joplin Server allows an attacker-influenced MIME type to determine how a resource is rendered and omits a protective Content-Disposition header when the title is empty.
When script-capable content is returned inline, the browser may execute it in the relevant origin. This behavior maps to CWE-79: Improper Neutralization of Input During Web Page Generation, because untrusted content is delivered in a context where it can be interpreted as active browser code.
Potential impact
- A script may execute when a victim opens a public share
- Same-origin application data may be read when content shares the application origin
- Actions may be performed using an authenticated victim's session
- Anti-CSRF tokens or administrative data could be exposed
- User accounts, shared content, or server data may be compromised
- Impact may be limited to the separate user-content origin when origin isolation is configured
General mitigation guidance
Mitigation typically focuses on preventing user-controlled files from executing as active content and separating content trust boundaries.
Common defensive patterns include:
- Serve uploaded resources with a forced download disposition unless inline rendering is explicitly required
- Validate and constrain MIME types using an allowlist rather than trusting client-supplied metadata
- Reject or safely transform script-capable formats such as SVG when they are not required
- Serve user-controlled content from a dedicated, isolated origin without application authentication context
- Apply appropriate Content-Type, Content-Disposition, and browser isolation policies
- Ensure empty, missing, or malformed resource metadata follows the safest response path
- Limit account privileges and session capabilities to reduce the consequences of browser-based attacks
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis and code review of file-serving routes for reflected MIME types and conditional security headers
- Tests covering empty filenames or titles, unusual media types, inline rendering, and public-share access
- Dynamic checks confirming that uploaded content is downloaded or isolated rather than executed
- Web application policies requiring user content to be served from a separate origin
- Monitoring for public-share resources with script-capable types and unexpected authenticated requests
- Automated security review tools that flag reflected content metadata and missing browser protection headers
