CVE-2023-49314

Asana Desktop 2.1.0 on macOS allows code injection because of specific Electron Fuses. There is inadequate protection against code injection through settings such as RunAsNode and EnableNodeCliInspectArguments, and thus r3ggi/electroniz3r can be used to perform an attack.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://asana.com/pt/download	Product
https://github.com/electron/fuses	Product
https://github.com/louiselalanne/CVE-2023-49314	Third Party Advisory
https://github.com/r3ggi/electroniz3r	Product
https://www.electronjs.org/blog/statement-run-as-node-cves
https://www.electronjs.org/docs/latest/tutorial/fuses	Technical Description

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:asana:desktop:2.1.0:*:*:*:*:*:*:*

cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-11-28 15:15

Updated : 2024-02-16 16:15

NVD link : CVE-2023-49314

Mitre link : CVE-2023-49314

CVE.ORG link : CVE-2023-49314

JSON object : View

Products Affected

asana

desktop

apple

macos

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2023-49314", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2023-11-28T15:15:07.770", "references": [{"url": "https://asana.com/pt/download", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/electron/fuses", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/louiselalanne/CVE-2023-49314", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/r3ggi/electroniz3r", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://www.electronjs.org/blog/statement-run-as-node-cves", "source": "cve@mitre.org"}, {"url": "https://www.electronjs.org/docs/latest/tutorial/fuses", "tags": ["Technical Description"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Asana Desktop 2.1.0 on macOS allows code injection because of specific Electron Fuses. There is inadequate protection against code injection through settings such as RunAsNode and EnableNodeCliInspectArguments, and thus r3ggi/electroniz3r can be used to perform an attack."}, {"lang": "es", "value": "Asana Desktop 2.1.0 en macOS permite la inyecci\u00f3n de c\u00f3digo gracias a Electron Fuses espec\u00edficos. Existe una protecci\u00f3n inadecuada contra la inyecci\u00f3n de c\u00f3digo a trav\u00e9s de configuraciones como RunAsNode y EnableNodeCliInspectArguments y, por lo tanto, se puede utilizar r3ggi/electroniz3r para realizar un ataque."}], "lastModified": "2024-02-16T16:15:57.360", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:asana:desktop:2.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0E24DCAF-4DF5-4EFD-B838-BEEA57FAE468"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}