PT-2023-2283 · 3Cx · 3Cx Desktopapp Electron Macos+2

John Hammond + 1 · Published 2023-03-30 · Updated 2024-01-09 · CVE-2023-29059

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions 3CX DesktopApp versions 18.11.1213 through 18.12.416 3CX DesktopApp Electron Windows application versions 18.12.407 through 18.12.416 3CX DesktopApp Electron macOS application versions 18.11.1213 through 18.12.416

Description The 3CX DesktopApp has embedded malicious code, which has been exploited in the wild in March 2023. This issue affects the Electron Windows and macOS applications. The malicious code allows a remote attacker to execute arbitrary code. There have been real-world incidents where this issue was exploited, with reports of a backdoor being installed on some machines, potentially as part of a targeted attack. The estimated number of affected devices is not specified, but it is reported that the attackers targeted their victims with precision.

Recommendations For 3CX DesktopApp versions 18.11.1213 through 18.12.416, update to a version later than 18.12.416 to resolve the issue. For 3CX DesktopApp Electron Windows application versions 18.12.407 through 18.12.416, update to a version later than 18.12.416 to resolve the issue. For 3CX DesktopApp Electron macOS application versions 18.11.1213 through 18.12.416, update to a version later than 18.12.416 to resolve the issue. As a temporary workaround, consider restricting access to the affected applications until a patch is available.

Exploit

Fix

RCE

Weakness Enumeration

CWE-506

Related Identifiers

BDU:2023-02044

CVE-2023-29059

Affected Products

3Cx Desktopapp

3Cx Desktopapp Electron Windows

3Cx Desktopapp Electron Macos

References · 20

• 🔥 https://huntress.com/blog/3cx-voip-software-compromise-supply-chain-threats · Exploit
• 🔥 https://fortinet.com/blog/threat-research/3cx-desktop-app-compromised · Exploit
• 🔥 https://news.sophos.com/en-us/2023/03/29/3cx-dll-sideloading-attack · Exploit
• 🔥 https://crowdstrike.com/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers · Exploit
• https://3cx.com/blog/news/desktopapp-security-alert · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-29059 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-29059 · Security Note
• https://bdu.fstec.ru/vul/2023-02044 · Security Note
• https://t.me/cibsecurity/61180 · Telegram Post
• https://t.me/cvenotify/47211 · Telegram Post
• https://t.me/isacarusec/6691 · Telegram Post
• https://t.me/aptreports/3418 · Telegram Post
• https://cwe.mitre.org/data/definitions/506.html · Note
• https://t.me/tomhunter/1540 · Telegram Post
• https://t.me/pentestingnews/34592 · Telegram Post