Zepl Notebook - Remote Code Execution

[<ghost () undervurse com>]

Exploit Title: Zepl Notebook - Remote Code Execution
Date: 9/28/2021
Vendor Homepage: https://zepl.com/
Software Link: https://app.zepl.com/
Version: All previous versions of product to the date of this submission
Tested on: The issue affects all versions of the product up to the date of this submission
Exploit Authors: Josh Sheppard & Pathfynder Inc
Exploit Contact: ghost a t undervurse dot_com & josh a t pathfynder dot_io
Exploit Technique: Remote
CVE ID: CVE-2021-42950
 1. Description
 A remote code execution vulnerability has been discovered in Zepl's Notebooks product. Users can register for an 
account and are allocated a set number of credits to try the product. Once users authenticate, they can proceed to 
create a new organization by which additional users can be added for various collaboration abilities. Once this has 
been established, users can then create new Zepl Notebooks with various languages, contexts and deployment scenarios. 
Upon creating a new notebook with specially crafted malicious code, a user can then launch remote code execution.
 This vulnerability effects all previous versions of their Notebook product suite.
 2. Disclosure Timeline
 9/28/21 - Discovery and Exploitation
9/28/21 - Vendor Notified
2/16/22 - CVE Assignment
2/17/22 - Public Disclosure
 3. Mitigation
 Hotfix applied to vendors SAAS solution, no action is necessary at this time.

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/