fkie_cve-2023-23623
Vulnerability from fkie_nvd
Published
2023-09-06 21:15
Modified
2024-11-21 07:46
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. A Content-Security-Policy that disables eval, specifically setting a `script-src` directive and _not_ providing `unsafe-eval` in that directive, is not respected in renderers that have sandbox disabled. i.e. `sandbox: false` in the `webPreferences` object. This allows usage of methods like `eval()` and `new Function` unexpectedly which can result in an expanded attack surface. This issue only ever affected the 22 and 23 major versions of Electron and has been fixed in the latest versions of those release lines. Specifically, these versions contain the fixes: 22.0.1 and 23.0.0-alpha.2 We recommend all apps upgrade to the latest stable version of Electron. If upgrading isn't possible, this issue can be addressed without upgrading by enabling `sandbox: true` on all renderers.
References
security-advisories@github.comhttps://github.com/electron/electron/security/advisories/GHSA-gxh7-wv9q-fwfrMitigation, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/electron/electron/security/advisories/GHSA-gxh7-wv9q-fwfrMitigation, Vendor Advisory
Impacted products
Vendor Product Version
electronjs electron 22.0.0
electronjs electron 22.0.0
electronjs electron 22.0.0
electronjs electron 22.0.0
electronjs electron 22.0.0
electronjs electron 22.0.0
electronjs electron 22.0.0
electronjs electron 22.0.0
electronjs electron 22.0.0
electronjs electron 23.0.0


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:electronjs:electron:22.0.0:-:*:*:*:node.js:*:*",
              "matchCriteriaId": "EA67DC7F-0492-45A6-A585-C1F6BA8CB125",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:22.0.0:beta1:*:*:*:node.js:*:*",
              "matchCriteriaId": "8313BBF8-2C7B-471E-B379-E8F587EB4F98",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:22.0.0:beta2:*:*:*:node.js:*:*",
              "matchCriteriaId": "9B73F495-8C0E-409E-86AC-2FC1A214AA9F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:22.0.0:beta3:*:*:*:node.js:*:*",
              "matchCriteriaId": "77E1E30F-0BAC-409B-B2D3-FF3B1FDCFE6A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:22.0.0:beta4:*:*:*:node.js:*:*",
              "matchCriteriaId": "6C556804-A20C-4E9F-8F4D-8E824A0032D8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:22.0.0:beta5:*:*:*:node.js:*:*",
              "matchCriteriaId": "F0995881-8E6C-4B2C-9F3A-F10668916039",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:22.0.0:beta6:*:*:*:node.js:*:*",
              "matchCriteriaId": "EB9BD805-BAC9-425D-A590-28B0FB68C3F0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:22.0.0:beta7:*:*:*:node.js:*:*",
              "matchCriteriaId": "197DA034-183C-4407-BD95-B610CBF980A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:22.0.0:beta8:*:*:*:node.js:*:*",
              "matchCriteriaId": "D14A589D-E6F7-4ED7-A123-C83633AC2004",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:23.0.0:alpha1:*:*:*:node.js:*:*",
              "matchCriteriaId": "8074214C-1787-46B6-A5CC-8DF31BC269EF",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. A Content-Security-Policy that disables eval, specifically setting a `script-src` directive and _not_ providing `unsafe-eval` in that directive, is not respected in renderers that have sandbox disabled.  i.e. `sandbox: false` in the `webPreferences` object. This allows usage of methods like `eval()` and `new Function` unexpectedly which can result in an expanded attack surface. This issue only ever affected the 22 and 23 major versions of Electron and has been fixed in the latest versions of those release lines. Specifically, these versions contain the fixes: 22.0.1 and 23.0.0-alpha.2 We recommend all apps upgrade to the latest stable version of Electron. If upgrading isn\u0027t possible, this issue can be addressed without upgrading by enabling `sandbox: true` on all renderers."
    },
    {
      "lang": "es",
      "value": "Electron es un framework que le permite escribir aplicaciones de escritorio multiplataforma utilizando JavaScript, HTML y CSS. Una pol\u00edtica de seguridad de contenido que deshabilita la evaluaci\u00f3n, espec\u00edficamente estableciendo una directiva `script-src` y _no_ proporcionando `unsafe-eval` en esa directiva, no se respeta en los renderizadores que tienen la zona de pruebas deshabilitada. es decir, `sandbox: false` en el objeto `webPreferences`. Esto permite el uso inesperado de m\u00e9todos como `eval()` y `new Function`, lo que puede resultar en una superficie de ataque ampliada. Este problema solo afect\u00f3 a las versiones principales 22 y 23 de Electron y se solucion\u00f3 en las \u00faltimas versiones de esas l\u00edneas de lanzamiento. Espec\u00edficamente, estas versiones contienen las correcciones: 22.0.1 y 23.0.0-alpha.2. Recomendamos que todas las aplicaciones actualicen a la \u00faltima versi\u00f3n estable de Electron. Si no es posible realizar la actualizaci\u00f3n, este problema se puede solucionar sin realizar la actualizaci\u00f3n habilitando `sandbox: true` en todos los renderizadores.\n"
    }
  ],
  "id": "CVE-2023-23623",
  "lastModified": "2024-11-21T07:46:33.427",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-09-06T21:15:08.977",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/electron/electron/security/advisories/GHSA-gxh7-wv9q-fwfr"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/electron/electron/security/advisories/GHSA-gxh7-wv9q-fwfr"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-670"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.