PT-2024-20051 · Notion · Notion

R3Ggi + 1 · Published 2024-01-27 · Updated 2024-09-25 · CVE-2024-23743

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Notion versions prior to 3.1.0

Description The issue might allow code execution because of RunAsNode and enableNodeClilnspectArguments. The vendor states that the attacker must launch the Notion Desktop application with nonstandard flags that turn the Electron-based application into a Node.js execution environment.

Recommendations For Notion versions prior to 3.1.0, consider disabling the RunAsNode and enableNodeClilnspectArguments components as a temporary workaround until a patch is available. Restrict access to the Notion Desktop application to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-250

Related Identifiers

CVE-2024-23743

Affected Products

Notion

References · 12

• 🔥 https://github.com/V3x0r/CVE-2024-23743 · Exploit
• https://osv.dev/vulnerability/CVE-2024-23743 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23743 · Security Note
• https://github.com/r3ggi/electroniz3r · Note
• https://t.me/cvenotify/71741 · Telegram Post
• https://t.me/cvenotify/69010 · Telegram Post
• https://twitter.com/CVEnew/status/1751425227081281868 · Twitter Post
• https://t.me/cvenotify/71299 · Telegram Post
• https://electronjs.org/blog/statement-run-as-node-cves · Note
• https://t.me/cvenotify/72868 · Telegram Post
• https://t.me/cvenotify/88379 · Telegram Post
• https://t.me/cvenotify/96041 · Telegram Post