Menu ▾ ▴

#1309 A malicious script can cause harm by escaping the security sandbox

FreeMind_1.0.1
open
nobody
None
5
3 hours ago
8 hours ago
Daniel Polansky
No

Issue/bug report itself

According to a 2017 Freeplane report (Freeplane is a fork of FreeMind):
https://docs.freeplane.org/scripting/Groovy_scripts_and_formulas_can_escape_sandbox.html
"A malicious mind map containing scripts or formulas can be used to escape the JVM sandbox and take full control over the victim's computer by leveraging Groovy to violate Java's access modifiers and disable the Security Manager. We recommend all our users to upgrade to the latest version as soon as
The problem almost certainly applies to FreeMind Groovy scripting as well to some extent. In Freeplane, the problem impacts more features/functions.

A solution for end users in the absence of a fix in FreeMind

As an end user, you should do the following:

  • If you open a mind map from an untrusworthy/untrusted source, do not run any scripts, whether 1) via Tools > Script Editor and then Actions > Run or 2) by pressing Alt + F8 to run all scripts.
  • To be more risk-averse, only open mind maps that are your own or those you obtain from trustworthy/trusted sources.
  • To be more risk-averse, do not add "startup_groovy_script" property to your setttings (FreeMind 1.0.1/1.0.1). If you do add that property and it points to a trusted/safe script, you should be safe.

Alternatively:

  • End users can use FreeMind 0.8.1 (it does not have Groovy scripting) or older.
  • End users can use Freeplane, a FreeMind fork that some users like and some not so much.

FreeMind versions impacted

All versions that support Groovy scripting (and thus, starting at FreeMind 0.9.0), currently up to FreeMind 1.0.1 and 1.1.0 beta 2 .

Question on Java disabling Security Manager

Java disabled SecurityManager class altogether:

How does Freeplane address the disablemenbt, given it is using SecurityManager?

Discussion

  • Daniel Polansky

    Daniel Polansky - 7 hours ago
    • Description has changed:

    Diff:

    --- old
+++ new
@@ -19,5 +19,5 @@

 Links
 -------
-https://docs.freeplane.org/scripting/Groovy_scripts_and_formulas_can_escape_sandbox.html
-https://openjdk.org/jeps/486
+* https://docs.freeplane.org/scripting/Groovy_scripts_and_formulas_can_escape_sandbox.html
+* https://openjdk.org/jeps/486
     

  • Daniel Polansky

    Daniel Polansky - 7 hours ago
    • Description has changed:

    Diff:

    --- old
+++ new
@@ -7,7 +7,7 @@

 A solution for end users in the absence of a fix in FreeMind
 --------------------------------------
-End users should only open mind maps that are their own or mind maps obtained from trustworthy sources. For a mind map obtained from a source where there is some doubt, an end user can use e.g. the command-line tools grep (Linux) or findstr (Windows) to check whether there is any script in the mind map.
+End users should only open mind maps that are their own or mind maps obtained from trustworthy sources. For a mind map obtained from a source where there is some doubt, an end user can use e.g. the command-line tools grep (Linux) or findstr (Windows) to check whether there is any script in the mind map. Examples: "grep script1 MyMap.mm"; "findstr script1 MyMap.mm"; if these searches find something, there may be a script embedded (see also https://freemind.sourceforge.io/wiki/index.php/Scripting). One may also use e.g. Notepadd++ to open the file and use Control + F for "script1".

 Question on Java disabling Security Manager
 --------------------------------------------------------
     

  • Daniel Polansky

    Daniel Polansky - 7 hours ago
    • Description has changed:

    Diff:

    --- old
+++ new
@@ -8,6 +8,14 @@
 A solution for end users in the absence of a fix in FreeMind
 --------------------------------------
 End users should only open mind maps that are their own or mind maps obtained from trustworthy sources. For a mind map obtained from a source where there is some doubt, an end user can use e.g. the command-line tools grep (Linux) or findstr (Windows) to check whether there is any script in the mind map. Examples: "grep script1 MyMap.mm"; "findstr script1 MyMap.mm"; if these searches find something, there may be a script embedded (see also https://freemind.sourceforge.io/wiki/index.php/Scripting). One may also use e.g. Notepadd++ to open the file and use Control + F for "script1".
+
+Alternatively:
+* End users can use FreeMind 0.8.1 (it does not have Groovy scripting) or older.
+* End users can use Freeplane, a FreeMind for that some users like and some not so much.
+
+FreeMind versions impacted
+-----------------------------------
+All versions that support Groovy scripting (and thus, starting at FreeMind 0.9.0), currently up to FreeMind 1.0.1 and 1.1.0 beta 2 .

 Question on Java disabling Security Manager
 --------------------------------------------------------
     

  • Daniel Polansky

    Daniel Polansky - 7 hours ago
    • Description has changed:

    Diff:

    --- old
+++ new
@@ -11,7 +11,7 @@

 Alternatively:

 * End users can use FreeMind 0.8.1 (it does not have Groovy scripting) or older.
-* End users can use Freeplane, a FreeMind for that some users like and some not so much.
+* End users can use Freeplane, a FreeMind fork that some users like and some not so much.

 FreeMind versions impacted
 -----------------------------------
     

  • Daniel Polansky

    Daniel Polansky - 7 hours ago
    • Description has changed:

    Diff:

    --- old
+++ new
@@ -7,7 +7,7 @@

 A solution for end users in the absence of a fix in FreeMind
 --------------------------------------
-End users should only open mind maps that are their own or mind maps obtained from trustworthy sources. For a mind map obtained from a source where there is some doubt, an end user can use e.g. the command-line tools grep (Linux) or findstr (Windows) to check whether there is any script in the mind map. Examples: "grep script1 MyMap.mm"; "findstr script1 MyMap.mm"; if these searches find something, there may be a script embedded (see also https://freemind.sourceforge.io/wiki/index.php/Scripting). One may also use e.g. Notepadd++ to open the file and use Control + F for "script1".
+End users should only open mind maps that are their own or mind maps obtained from trustworthy sources. For a mind map obtained from a source where there is some doubt, an end user can use e.g. the command-line tools grep (Linux) or findstr (Windows) to check whether there is any script in the mind map. Examples: "grep script1 MyMap.mm"; "findstr script1 MyMap.mm"; if these searches find something, there may be a script embedded (see also https://freemind.sourceforge.io/wiki/index.php/Scripting). One may also use e.g. Notepad++ to open the file and use Control + F for "script1".

 Alternatively:

 * End users can use FreeMind 0.8.1 (it does not have Groovy scripting) or older.
     

  • Daniel Polansky

    Daniel Polansky - 7 hours ago
    • Description has changed:

    Diff:

    --- old
+++ new
@@ -19,7 +19,7 @@

 Question on Java disabling Security Manager
 --------------------------------------------------------
-Java disabled SecurityManager class altogether (https://openjdk.org/jeps/486, JEP 486: Permanently Disable the Security Manager). How does Freeplane address the disablemenbt, given it is using SecurityManager?
+Java disabled SecurityManager class altogether: (https://openjdk.org/jeps/486)[JEP 486: Permanently Disable the Security Manager]. How does Freeplane address the disablemenbt, given it is using SecurityManager?

 Solution ideas
 ------------------
     

  • Daniel Polansky

    Daniel Polansky - 7 hours ago
    • Description has changed:

    Diff:

    --- old
+++ new
@@ -19,7 +19,12 @@

 Question on Java disabling Security Manager
 --------------------------------------------------------
-Java disabled SecurityManager class altogether: (https://openjdk.org/jeps/486)[JEP 486: Permanently Disable the Security Manager]. How does Freeplane address the disablemenbt, given it is using SecurityManager?
+Java disabled SecurityManager class altogether:
+
+JEP 486: Permanently Disable the Security Manager
+https://openjdk.org/jeps/486
+

+ How does Freeplane address the disablemenbt, given it is using SecurityManager?

 Solution ideas
 ------------------
     

  • Daniel Polansky

    Daniel Polansky - 7 hours ago
    • Description has changed:

    Diff:

    --- old
+++ new
@@ -20,11 +20,9 @@
 Question on Java disabling Security Manager
 --------------------------------------------------------
 Java disabled SecurityManager class altogether:
+* [JEP 486: Permanently Disable the Security Manager](https://openjdk.org/jeps/486)

-JEP 486: Permanently Disable the Security Manager
-https://openjdk.org/jeps/486
-

- How does Freeplane address the disablemenbt, given it is using SecurityManager?
+How does Freeplane address the disablemenbt, given it is using SecurityManager?

 Solution ideas
 ------------------
@@ -32,5 +30,6 @@

 Links
 -------
-* https://docs.freeplane.org/scripting/Groovy_scripts_and_formulas_can_escape_sandbox.html
-* https://openjdk.org/jeps/486
+* [Groovy scripts and formulas can escape sandbox - Freeplane Documentation](https://docs.freeplane.org/scripting/Groovy_scripts_and_formulas_can_escape_sandbox.html), freeplane.org
+* [JEP 486: Permanently Disable the Security Manager](https://openjdk.org/jeps/486), openjdk.org
+* [Freeplane can not use Java version >= 24 because of removal of the Java Security Manager](https://github.com/freeplane/freeplane/discussions/2124), github.com
     

  • Daniel Polansky

    Daniel Polansky - 7 hours ago
    • Description has changed:

    Diff:

    --- old
+++ new
@@ -3,7 +3,7 @@
 According to a 2017 Freeplane report (Freeplane is a fork of FreeMind):
 https://docs.freeplane.org/scripting/Groovy_scripts_and_formulas_can_escape_sandbox.html
 "A malicious mind map containing scripts or formulas can be used to escape the JVM sandbox and take full control over the victim's computer by leveraging Groovy to violate Java's access modifiers and disable the Security Manager. We recommend all our users to upgrade to the latest version as soon as possible."
-The problem almost certainly applies to FreeMind as well.
+The problem almost certainly applies to FreeMind Groovy scripting as well.

 A solution for end users in the absence of a fix in FreeMind
 --------------------------------------
     

  • Daniel Polansky

    Daniel Polansky - 5 hours ago
    • Description has changed:

    Diff:

    --- old
+++ new
@@ -2,12 +2,17 @@
 -----------------------------
 According to a 2017 Freeplane report (Freeplane is a fork of FreeMind):
 https://docs.freeplane.org/scripting/Groovy_scripts_and_formulas_can_escape_sandbox.html
-"A malicious mind map containing scripts or formulas can be used to escape the JVM sandbox and take full control over the victim's computer by leveraging Groovy to violate Java's access modifiers and disable the Security Manager. We recommend all our users to upgrade to the latest version as soon as possible."
-The problem almost certainly applies to FreeMind Groovy scripting as well.
+"A malicious mind map containing scripts or formulas can be used to escape the JVM sandbox and take full control over the victim's computer by leveraging Groovy to violate Java's access modifiers and disable the Security Manager. We recommend all our users to upgrade to the latest version as soon as 
+The problem almost certainly applies to FreeMind Groovy scripting as well to some extent. In Freeplane, the problem impacts more features/functions.

 A solution for end users in the absence of a fix in FreeMind
 --------------------------------------
-End users should only open mind maps that are their own or mind maps obtained from trustworthy sources. For a mind map obtained from a source where there is some doubt, an end user can use e.g. the command-line tools grep (Linux) or findstr (Windows) to check whether there is any script in the mind map. Examples: "grep script1 MyMap.mm"; "findstr script1 MyMap.mm"; if these searches find something, there may be a script embedded (see also https://freemind.sourceforge.io/wiki/index.php/Scripting). One may also use e.g. Notepad++ to open the file and use Control + F for "script1".
+As an end user, you should do the following:
+* If you open a mind map from an untrusworthy/untrusted source, do not run any scripts, whether 1) via Tools > Script Editor and then Actions > Run or 2) by pressing Alt + F8 to run all scripts.
+* To be more risk-averse, only open mind maps that are your own or those you obtain from trustworthy/trusted sources.
+* To be more risk-averse, do not add "startup_groovy_script" property to your setttings  (FreeMind 1.0.1/1.0.1). If you do add that property and it points to a trusted/safe script, you should be  safe.
+
+For a mind map obtained from a source where there is some doubt, an end user can use e.g. the command-line tools grep (Linux) or findstr (Windows) to check whether there is any script in the mind map. Examples: "grep script1 MyMap.mm"; "findstr script1 MyMap.mm"; if these searches find something, there may be a script embedded (see also https://freemind.sourceforge.io/wiki/index.php/Scripting). One may also use e.g. Notepad++ to open the file and use Control + F for "script1".

 Alternatively:

 * End users can use FreeMind 0.8.1 (it does not have Groovy scripting) or older.
@@ -33,3 +38,4 @@
 * [Groovy scripts and formulas can escape sandbox - Freeplane Documentation](https://docs.freeplane.org/scripting/Groovy_scripts_and_formulas_can_escape_sandbox.html), freeplane.org
 * [JEP 486: Permanently Disable the Security Manager](https://openjdk.org/jeps/486), openjdk.org
 * [Freeplane can not use Java version >= 24 because of removal of the Java Security Manager](https://github.com/freeplane/freeplane/discussions/2124), github.com
+* https://freemind.sourceforge.io/wiki/index.php/Scripting ___TBD___
     

  • Daniel Polansky

    Daniel Polansky - 5 hours ago
    • Description has changed:

    Diff:

    --- old
+++ new
@@ -11,8 +11,6 @@

 * If you open a mind map from an untrusworthy/untrusted source, do not run any scripts, whether 1) via Tools > Script Editor and then Actions > Run or 2) by pressing Alt + F8 to run all scripts.
 * To be more risk-averse, only open mind maps that are your own or those you obtain from trustworthy/trusted sources.
 * To be more risk-averse, do not add "startup_groovy_script" property to your setttings  (FreeMind 1.0.1/1.0.1). If you do add that property and it points to a trusted/safe script, you should be  safe.
-
-For a mind map obtained from a source where there is some doubt, an end user can use e.g. the command-line tools grep (Linux) or findstr (Windows) to check whether there is any script in the mind map. Examples: "grep script1 MyMap.mm"; "findstr script1 MyMap.mm"; if these searches find something, there may be a script embedded (see also https://freemind.sourceforge.io/wiki/index.php/Scripting). One may also use e.g. Notepad++ to open the file and use Control + F for "script1".

 Alternatively:

 * End users can use FreeMind 0.8.1 (it does not have Groovy scripting) or older.
     

  • Daniel Polansky

    Daniel Polansky - 5 hours ago
    • summary: A malicious script in a mind map can cause harm --> A malicious script in a mind map can cause harm if run by the user
     

  • Daniel Polansky

    Daniel Polansky - 4 hours ago
    • Description has changed:

    Diff:

    --- old
+++ new
@@ -36,4 +36,4 @@

 * [Groovy scripts and formulas can escape sandbox - Freeplane Documentation](https://docs.freeplane.org/scripting/Groovy_scripts_and_formulas_can_escape_sandbox.html), freeplane.org
 * [JEP 486: Permanently Disable the Security Manager](https://openjdk.org/jeps/486), openjdk.org
 * [Freeplane can not use Java version >= 24 because of removal of the Java Security Manager](https://github.com/freeplane/freeplane/discussions/2124), github.com
-* https://freemind.sourceforge.io/wiki/index.php/Scripting ___TBD___
+* [Scripting](https://freemind.sourceforge.io/wiki/index.php/Scripting), freemind.sourceforge.io
     

  • Daniel Polansky

    Daniel Polansky - 4 hours ago
    • Description has changed:

    Diff:

    --- old
+++ new
@@ -27,10 +27,6 @@

 How does Freeplane address the disablemenbt, given it is using SecurityManager?

-Solution ideas
-------------------
-To address the disablement of SecurityManager in Java and risks associated with malicious scripting, FreeMind could ask the user for confirmation before opening any mind map with a script.
-
 Links
 -------

 * [Groovy scripts and formulas can escape sandbox - Freeplane Documentation](https://docs.freeplane.org/scripting/Groovy_scripts_and_formulas_can_escape_sandbox.html), freeplane.org
     

  • Daniel Polansky

    Daniel Polansky - 3 hours ago
    • summary: A malicious script in a mind map can cause harm if run by the user --> A malicious script can cause harm by escaping the security sandbox
     

Log in to post a comment.

Cerberus Logo