PT-2024-19826 · Meta · Meta Spark Studio

Published 2024-01-16 · Updated 2024-01-30 · CVE-2024-23347

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Meta Spark Studio versions prior to v176

Description When opening a new project, Meta Spark Studio would execute scripts defined inside of a package.json file included as part of that project. Those scripts would have the ability to execute arbitrary code on the system as the application.

Recommendations For versions prior to v176, consider disabling the execution of scripts defined in the package.json file until a patch is available. Restrict access to the package.json file to minimize the risk of exploitation. Update to version v176 or later to resolve the issue.

Fix

Related Identifiers

CVE-2024-23347

Affected Products

Meta Spark Studio

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-23347 · Security Note
• https://osv.dev/vulnerability/CVE-2024-23347 · Vendor Advisory
• https://facebook.com/security/advisories/cve-2024-23347 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1747342169445163512 · Twitter Post
• https://twitter.com/CVEnew/status/1747331018099503326 · Twitter Post
• https://t.me/cvenotify/69207 · Telegram Post