CVE-2024-23347 Code injection in Meta Spark Studio
Attackers can execute arbitrary code by tricking users into opening a malicious project containing scripts in package.json.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-23347?
CVE-2024-23347 is a high-severity code injection vulnerability in Meta Spark Studio, published on 16 Jan 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Prior to v176, when opening a new project Meta Spark Studio would execute scripts defined inside of a package.json file included as part of that project. Those scripts would have the ability to execute arbitrary code on the system as the application.
Which versions are affected by CVE-2024-23347?
It affects 1 product.
Products include Facebook Meta Spark Studio.
How do I fix CVE-2024-23347?
No fix has been published for CVE-2024-23347 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-23347 being exploited?
There is no known exploitation of CVE-2024-23347 in the wild and no public exploit code.
Sources
Also known as GHSA-f63q-6c68-mrcx.