PT-2023-19083 · Electron · Electron

Andreasdj · Publicado 2023-09-06 · Atualizado 2024-06-15 · CVE-2023-23623

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Electron versions 22 through 23

Description A Content-Security-Policy that disables eval is not respected in renderers with sandbox disabled, allowing methods like eval() and new Function to be used unexpectedly, which can result in an expanded attack surface. This issue is related to the script-src directive not including unsafe-eval. The affected renderers have sandbox: false in the webPreferences object.

Recommendations For Electron version 22, upgrade to version 22.0.1. For Electron version 23, upgrade to version 23.0.0-alpha.2. If upgrading is not possible, enable sandbox: true on all renderers as a temporary workaround. Alternatively, enabling contextIsolation: true on all renderers can also address the issue.

Exploit

Correção

Enumeração de Fraquezas

CWE-670

Identificadores relacionados

CVE-2023-23623

GHSA-GXH7-WV9Q-FWFR

OPENSUSE-SU-2024:12869-1

Produtos afetados

Electron

Referências · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23623.json · Exploit
• https://github.com/electron/electron · Nota
• https://github.com/electron/electron/security/advisories/GHSA-gxh7-wv9q-fwfr · Aviso do Fabricante
• https://github.com/electron/electron/commit/9e7fbc7021d8d716c43782249a552e55289c35db · Nota
• https://github.com/electron/electron/pull/36668 · Nota
• https://github.com/electron/electron/releases/tag/v22.0.1 · Nota
• https://github.com/electron/electron/pull/36667 · Nota
• https://osv.dev/vulnerability/CVE-2023-23623 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-23623 · Nota de Segurança
• https://suse.com/security/cve/CVE-2023-1811 · Nota
• https://osv.dev/vulnerability/GHSA-gxh7-wv9q-fwfr · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2023-23623 · Nota
• https://t.me/cvenotify/57679 · Publicação no Telegram
• https://suse.com/security/cve/CVE-2023-1810 · Nota
• https://twitter.com/CVEnew/status/1699519677867634785 · Publicação no Twitter