PT-2023-29850 · Tutanota · Tutanota

Pachinko2821 · Published 2023-12-15 · Updated 2023-12-28 · CVE-2023-46116

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Tutanota versions prior to 3.118.12

Description The issue concerns the handling of URL schemes in emails. Prior to version 3.118.12, Tutanota correctly blocks the file: URL scheme but fails to check other harmful schemes such as ftp: and smb:, which can be used by malicious actors to gain code execution on a victim's computer. Successful exploitation enables an attacker to gain code execution on a victim's computer.

Recommendations For versions prior to 3.118.12, update to version 3.118.12 or later to resolve the issue. As a temporary workaround, consider disabling the ability to open links in external applications until the update is applied. Restrict access to harmful URL schemes such as ftp: and smb: to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2023-46116

GHSA-MXGJ-PQ62-F644

Affected Products

Tutanota

References · 8

• 🔥 https://github.com/tutao/tutanota/security/advisories/GHSA-mxgj-pq62-f644 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46116.json · Exploit
• 🔥 https://user-images.githubusercontent.com/46137338/270564886-7a0389d3-f9ef-44e1-9f5e-57ccc72dcaa8.mp4 · Exploit
• https://github.com/tutao/tutanota/commit/88ecad17d00d05a722399aed35f0d280899d55a2 · Patch
• https://osv.dev/vulnerability/CVE-2023-46116 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46116 · Security Note
• https://github.com/tutao/tutanota/blob/master/src/desktop/ApplicationWindow.ts#L417 · Note
• https://github.com/tutao/tutanota/blob/master/src/desktop/ApplicationWindow.ts#L423 · Note