FKIE_CVE-2023-23623

Vulnerability from fkie_nvd - Published: 2023-09-06 21:15 - Updated: 2024-11-21 07:46
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. A Content-Security-Policy that disables eval, specifically setting a `script-src` directive and _not_ providing `unsafe-eval` in that directive, is not respected in renderers that have sandbox disabled. i.e. `sandbox: false` in the `webPreferences` object. This allows usage of methods like `eval()` and `new Function` unexpectedly which can result in an expanded attack surface. This issue only ever affected the 22 and 23 major versions of Electron and has been fixed in the latest versions of those release lines. Specifically, these versions contain the fixes: 22.0.1 and 23.0.0-alpha.2 We recommend all apps upgrade to the latest stable version of Electron. If upgrading isn't possible, this issue can be addressed without upgrading by enabling `sandbox: true` on all renderers.
References
security-advisories@github.comhttps://github.com/electron/electron/security/advisories/GHSA-gxh7-wv9q-fwfrMitigation, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/electron/electron/security/advisories/GHSA-gxh7-wv9q-fwfrMitigation, Vendor Advisory
Impacted products
Vendor Product Version
electronjs electron 22.0.0
electronjs electron 22.0.0
electronjs electron 22.0.0
electronjs electron 22.0.0
electronjs electron 22.0.0
electronjs electron 22.0.0
electronjs electron 22.0.0
electronjs electron 22.0.0
electronjs electron 22.0.0
electronjs electron 23.0.0
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:electronjs:electron:22.0.0:-:*:*:*:node.js:*:*",
              "matchCriteriaId": "EA67DC7F-0492-45A6-A585-C1F6BA8CB125",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:22.0.0:beta1:*:*:*:node.js:*:*",
              "matchCriteriaId": "8313BBF8-2C7B-471E-B379-E8F587EB4F98",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:22.0.0:beta2:*:*:*:node.js:*:*",
              "matchCriteriaId": "9B73F495-8C0E-409E-86AC-2FC1A214AA9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:22.0.0:beta3:*:*:*:node.js:*:*",
              "matchCriteriaId": "77E1E30F-0BAC-409B-B2D3-FF3B1FDCFE6A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:22.0.0:beta4:*:*:*:node.js:*:*",
              "matchCriteriaId": "6C556804-A20C-4E9F-8F4D-8E824A0032D8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:22.0.0:beta5:*:*:*:node.js:*:*",
              "matchCriteriaId": "F0995881-8E6C-4B2C-9F3A-F10668916039",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:22.0.0:beta6:*:*:*:node.js:*:*",
              "matchCriteriaId": "EB9BD805-BAC9-425D-A590-28B0FB68C3F0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:22.0.0:beta7:*:*:*:node.js:*:*",
              "matchCriteriaId": "197DA034-183C-4407-BD95-B610CBF980A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:22.0.0:beta8:*:*:*:node.js:*:*",
              "matchCriteriaId": "D14A589D-E6F7-4ED7-A123-C83633AC2004",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:23.0.0:alpha1:*:*:*:node.js:*:*",
              "matchCriteriaId": "8074214C-1787-46B6-A5CC-8DF31BC269EF",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. A Content-Security-Policy that disables eval, specifically setting a `script-src` directive and _not_ providing `unsafe-eval` in that directive, is not respected in renderers that have sandbox disabled.  i.e. `sandbox: false` in the `webPreferences` object. This allows usage of methods like `eval()` and `new Function` unexpectedly which can result in an expanded attack surface. This issue only ever affected the 22 and 23 major versions of Electron and has been fixed in the latest versions of those release lines. Specifically, these versions contain the fixes: 22.0.1 and 23.0.0-alpha.2 We recommend all apps upgrade to the latest stable version of Electron. If upgrading isn\u0027t possible, this issue can be addressed without upgrading by enabling `sandbox: true` on all renderers."
    },
    {
      "lang": "es",
      "value": "Electron es un framework que le permite escribir aplicaciones de escritorio multiplataforma utilizando JavaScript, HTML y CSS. Una pol\u00edtica de seguridad de contenido que deshabilita la evaluaci\u00f3n, espec\u00edficamente estableciendo una directiva `script-src` y _no_ proporcionando `unsafe-eval` en esa directiva, no se respeta en los renderizadores que tienen la zona de pruebas deshabilitada. es decir, `sandbox: false` en el objeto `webPreferences`. Esto permite el uso inesperado de m\u00e9todos como `eval()` y `new Function`, lo que puede resultar en una superficie de ataque ampliada. Este problema solo afect\u00f3 a las versiones principales 22 y 23 de Electron y se solucion\u00f3 en las \u00faltimas versiones de esas l\u00edneas de lanzamiento. Espec\u00edficamente, estas versiones contienen las correcciones: 22.0.1 y 23.0.0-alpha.2. Recomendamos que todas las aplicaciones actualicen a la \u00faltima versi\u00f3n estable de Electron. Si no es posible realizar la actualizaci\u00f3n, este problema se puede solucionar sin realizar la actualizaci\u00f3n habilitando `sandbox: true` en todos los renderizadores.\n"
    }
  ],
  "id": "CVE-2023-23623",
  "lastModified": "2024-11-21T07:46:33.427",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-09-06T21:15:08.977",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/electron/electron/security/advisories/GHSA-gxh7-wv9q-fwfr"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/electron/electron/security/advisories/GHSA-gxh7-wv9q-fwfr"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-670"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.