CVE-2024-23745

In Notion Web Clipper 1.0.3(7), a .nib file is susceptible to the Dirty NIB attack. NIB files can be manipulated to execute arbitrary commands. Additionally, even if a NIB file is modified within an application, Gatekeeper may still permit the execution of the application, enabling the execution of arbitrary commands within the application's context. NOTE: the vendor's perspective is that this is simply an instance of CVE-2022-48505, cannot properly be categorized as a product-level vulnerability, and cannot have a product-level fix because it is about incorrect caching of file signatures on macOS.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://blog.xpnsec.com/dirtynib/
https://chromium.googlesource.com/chromium/src/+/master/docs/security/faq.md#Why-arent-physically_local-attacks-in-Chromes-threat-model
https://github.com/louiselalanne/CVE-2024-23745	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:notion:web_clipper:1.0.3\(7\):*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-01-31 02:15

Updated : 2024-05-17 02:36

NVD link : CVE-2024-23745

Mitre link : CVE-2024-23745

CVE.ORG link : CVE-2024-23745

JSON object : View

Products Affected

notion

web_clipper

CWE

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

{"id": "CVE-2024-23745", "cveTags": [{"tags": ["disputed"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2024-01-31T02:15:54.520", "references": [{"url": "https://blog.xpnsec.com/dirtynib/", "source": "cve@mitre.org"}, {"url": "https://chromium.googlesource.com/chromium/src/+/master/docs/security/faq.md#Why-arent-physically_local-attacks-in-Chromes-threat-model", "source": "cve@mitre.org"}, {"url": "https://github.com/louiselalanne/CVE-2024-23745", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "In Notion Web Clipper 1.0.3(7), a .nib file is susceptible to the Dirty NIB attack. NIB files can be manipulated to execute arbitrary commands. Additionally, even if a NIB file is modified within an application, Gatekeeper may still permit the execution of the application, enabling the execution of arbitrary commands within the application's context. NOTE: the vendor's perspective is that this is simply an instance of CVE-2022-48505, cannot properly be categorized as a product-level vulnerability, and cannot have a product-level fix because it is about incorrect caching of file signatures on macOS."}, {"lang": "es", "value": "En Notion Web Clipper 1.0.3(7), un archivo .nib es susceptible al ataque Dirty NIB. Los archivos NIB se pueden manipular para ejecutar comandos arbitrarios. Adem\u00e1s, incluso si un archivo NIB se modifica dentro de una aplicaci\u00f3n, Gatekeeper a\u00fan puede permitir la ejecuci\u00f3n de la aplicaci\u00f3n, permitiendo la ejecuci\u00f3n de comandos arbitrarios dentro del contexto de la aplicaci\u00f3n."}], "lastModified": "2024-05-17T02:36:38.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:notion:web_clipper:1.0.3\\(7\\):*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "576F54DE-EF87-494A-B7DF-8FCC28062CBD"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}