CVE-2024-23745
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
In Notion Web Clipper 1.0.3(7), a .nib file is susceptible to the Dirty NIB attack. NIB files can be manipulated to execute arbitrary commands. Additionally, even if a NIB file is modified within an application, Gatekeeper may still permit the execution of the application, enabling the execution of arbitrary commands within the application's context. NOTE: the vendor's perspective is that this is simply an instance of CVE-2022-48505, cannot properly be categorized as a product-level vulnerability, and cannot have a product-level fix because it is about incorrect caching of file signatures on macOS.
En Notion Web Clipper 1.0.3(7), un archivo .nib es susceptible al ataque Dirty NIB. Los archivos NIB se pueden manipular para ejecutar comandos arbitrarios. Además, incluso si un archivo NIB se modifica dentro de una aplicación, Gatekeeper aún puede permitir la ejecución de la aplicación, permitiendo la ejecución de comandos arbitrarios dentro del contexto de la aplicación.
CVSS Scores
SSVC
- Decision:Attend
Timeline
- 2024-01-21 CVE Reserved
- 2024-01-31 CVE Published
- 2024-08-07 EPSS Updated
- 2024-11-12 CVE Updated
- 2024-11-12 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
CAPEC
References (3)
| URL | Tag | Source |
|---|---|---|
| https://blog.xpnsec.com/dirtynib | ||
| https://chromium.googlesource.com/chromium/src/+/master/docs/security/faq.md#Why-arent-physically_local-attacks-in-Chromes-threat-model |
| URL | Date | SRC |
|---|---|---|
| https://github.com/louiselalanne/CVE-2024-23745 | 2024-11-12 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Notion Search vendor "Notion" | Web Clipper Search vendor "Notion" for product "Web Clipper" | 1.0.3\(7\) Search vendor "Notion" for product "Web Clipper" and version "1.0.3\(7\)" | - |
Affected
| ||||||