Exploit Title: Zepl Notebook - Remote Code Execution Date: 9/28/2021 Vendor Homepage: https://zepl.com/ Software Link: https://app.zepl.com/ Version: All previous versions of product to the date of this submission Tested on: The issue affects all versions of the product up to the date of this submission Exploit Authors: Josh Sheppard & Pathfynder Inc Exploit Contact: ghost a t undervurse dot_com & josh a t pathfynder dot_io Exploit Technique: Remote CVE ID: CVE-2021-42950 1. Description A remote code execution vulnerability has been discovered in Zepl's Notebooks product. Users can register for an account and are allocated a set number of credits to try the product. Once users authenticate, they can proceed to create a new organization by which additional users can be added for various collaboration abilities. Once this has been established, users can then create new Zepl Notebooks with various languages, contexts and deployment scenarios. Upon creating a new notebook with specially crafted malicious code, a user can then launch remote code execution. This vulnerability effects all previous versions of their Notebook product suite. 2. Disclosure Timeline 9/28/21 - Discovery and Exploitation 9/28/21 - Vendor Notified 2/16/22 - CVE Assignment 2/17/22 - Public Disclosure 3. Mitigation Hotfix applied to vendors SAAS solution, no action is necessary at this time.