PT-2023-19083 · Electron · Electron

Andreasdj · Published 2023-09-06 · Updated 2024-06-15 · CVE-2023-23623

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Electron versions 22 through 23

Description A Content-Security-Policy that disables eval is not respected in renderers with sandbox disabled, allowing methods like eval() and new Function to be used unexpectedly, which can result in an expanded attack surface. This issue is related to the script-src directive not including unsafe-eval. The affected renderers have sandbox: false in the webPreferences object.

Recommendations For Electron version 22, upgrade to version 22.0.1. For Electron version 23, upgrade to version 23.0.0-alpha.2. If upgrading is not possible, enable sandbox: true on all renderers as a temporary workaround. Alternatively, enabling contextIsolation: true on all renderers can also address the issue.

Exploit

Fix

Weakness Enumeration

CWE-670

Related Identifiers

CVE-2023-23623

GHSA-GXH7-WV9Q-FWFR

OPENSUSE-SU-2024:12869-1

Affected Products

Electron

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23623.json · Exploit
• https://github.com/electron/electron/security/advisories/GHSA-gxh7-wv9q-fwfr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-23623 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-23623 · Security Note
• https://osv.dev/vulnerability/GHSA-gxh7-wv9q-fwfr · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12869-1 · Vendor Advisory
• https://github.com/electron/electron · Note
• https://github.com/electron/electron/commit/9e7fbc7021d8d716c43782249a552e55289c35db · Note
• https://github.com/electron/electron/pull/36668 · Note
• https://github.com/electron/electron/releases/tag/v22.0.1 · Note
• https://github.com/electron/electron/pull/36667 · Note
• https://suse.com/security/cve/CVE-2023-1811 · Note
• https://suse.com/security/cve/CVE-2023-23623 · Note
• https://t.me/cvenotify/57679 · Telegram Post
• https://suse.com/security/cve/CVE-2023-1810 · Note