CVE-2024-23745 Code injection in n/a
Attackers can execute arbitrary commands by manipulating NIB files in Notion Web Clipper, bypassing macOS Gatekeeper checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-23745?
CVE-2024-23745 is a critical code injection vulnerability in n/a, published on 31 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Notion Web Clipper 1.0.3(7), a .nib file is susceptible to the Dirty NIB attack. NIB files can be manipulated to execute arbitrary commands. Additionally, even if a NIB file is modified within an application, Gatekeeper may still permit the execution of the application, enabling the execution of arbitrary commands within the application's context. NOTE: the vendor's perspective is that this is simply an instance of CVE-2022-48505, cannot properly be categorized as a product-level vulnerability, and cannot have a product-level fix because it is about incorrect caching of file signatures on macOS.
Weakness: CWE-77
Which versions are affected by CVE-2024-23745?
It affects 1 product.
Products include Notion Web Clipper.
How do I fix CVE-2024-23745?
No fix has been published for CVE-2024-23745 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-23745 being exploited?
There is no known exploitation of CVE-2024-23745 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-27hv-w8j5-r6ww.