{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-23623", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-01-16T17:07:46.243Z", "datePublished": "2023-09-06T20:16:10.381Z", "dateUpdated": "2024-08-02T10:35:33.639Z"}, "containers": {"cna": {"title": "Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled in Electron", "problemTypes": [{"descriptions": [{"cweId": "CWE-670", "lang": "en", "description": "CWE-670: Always-Incorrect Control Flow Implementation", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/electron/electron/security/advisories/GHSA-gxh7-wv9q-fwfr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/electron/electron/security/advisories/GHSA-gxh7-wv9q-fwfr"}], "affected": [{"vendor": "electron", "product": "electron", "versions": [{"version": ">= 22.0.0-beta.1, < 22.0.1", "status": "affected"}, {"version": ">= 23.0.0-alpha.1, < 23.0.0-alpha.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-09-06T20:16:10.381Z"}, "descriptions": [{"lang": "en", "value": "Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. A Content-Security-Policy that disables eval, specifically setting a `script-src` directive and _not_ providing `unsafe-eval` in that directive, is not respected in renderers that have sandbox disabled. i.e. `sandbox: false` in the `webPreferences` object. This allows usage of methods like `eval()` and `new Function` unexpectedly which can result in an expanded attack surface. This issue only ever affected the 22 and 23 major versions of Electron and has been fixed in the latest versions of those release lines. Specifically, these versions contain the fixes: 22.0.1 and 23.0.0-alpha.2 We recommend all apps upgrade to the latest stable version of Electron. If upgrading isn't possible, this issue can be addressed without upgrading by enabling `sandbox: true` on all renderers."}], "source": {"advisory": "GHSA-gxh7-wv9q-fwfr", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T10:35:33.639Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/electron/electron/security/advisories/GHSA-gxh7-wv9q-fwfr", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/electron/electron/security/advisories/GHSA-gxh7-wv9q-fwfr"}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:electronjs:electron:22.0.0:-:*:*:*:node.js:*:*", "matchCriteriaId": "EA67DC7F-0492-45A6-A585-C1F6BA8CB125", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:22.0.0:beta1:*:*:*:node.js:*:*", "matchCriteriaId": "8313BBF8-2C7B-471E-B379-E8F587EB4F98", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:22.0.0:beta2:*:*:*:node.js:*:*", "matchCriteriaId": "9B73F495-8C0E-409E-86AC-2FC1A214AA9F", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:22.0.0:beta3:*:*:*:node.js:*:*", "matchCriteriaId": "77E1E30F-0BAC-409B-B2D3-FF3B1FDCFE6A", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:22.0.0:beta4:*:*:*:node.js:*:*", "matchCriteriaId": "6C556804-A20C-4E9F-8F4D-8E824A0032D8", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:22.0.0:beta5:*:*:*:node.js:*:*", "matchCriteriaId": "F0995881-8E6C-4B2C-9F3A-F10668916039", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:22.0.0:beta6:*:*:*:node.js:*:*", "matchCriteriaId": "EB9BD805-BAC9-425D-A590-28B0FB68C3F0", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:22.0.0:beta7:*:*:*:node.js:*:*", "matchCriteriaId": "197DA034-183C-4407-BD95-B610CBF980A9", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:22.0.0:beta8:*:*:*:node.js:*:*", "matchCriteriaId": "D14A589D-E6F7-4ED7-A123-C83633AC2004", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:23.0.0:alpha1:*:*:*:node.js:*:*", "matchCriteriaId": "8074214C-1787-46B6-A5CC-8DF31BC269EF", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. A Content-Security-Policy that disables eval, specifically setting a `script-src` directive and _not_ providing `unsafe-eval` in that directive, is not respected in renderers that have sandbox disabled. i.e. `sandbox: false` in the `webPreferences` object. This allows usage of methods like `eval()` and `new Function` unexpectedly which can result in an expanded attack surface. This issue only ever affected the 22 and 23 major versions of Electron and has been fixed in the latest versions of those release lines. Specifically, these versions contain the fixes: 22.0.1 and 23.0.0-alpha.2 We recommend all apps upgrade to the latest stable version of Electron. If upgrading isn't possible, this issue can be addressed without upgrading by enabling `sandbox: true` on all renderers."}, {"lang": "es", "value": "Electron es un framework que le permite escribir aplicaciones de escritorio multiplataforma utilizando JavaScript, HTML y CSS. Una pol\u00edtica de seguridad de contenido que deshabilita la evaluaci\u00f3n, espec\u00edficamente estableciendo una directiva `script-src` y _no_ proporcionando `unsafe-eval` en esa directiva, no se respeta en los renderizadores que tienen la zona de pruebas deshabilitada. es decir, `sandbox: false` en el objeto `webPreferences`. Esto permite el uso inesperado de m\u00e9todos como `eval()` y `new Function`, lo que puede resultar en una superficie de ataque ampliada. Este problema solo afect\u00f3 a las versiones principales 22 y 23 de Electron y se solucion\u00f3 en las \u00faltimas versiones de esas l\u00edneas de lanzamiento. Espec\u00edficamente, estas versiones contienen las correcciones: 22.0.1 y 23.0.0-alpha.2. Recomendamos que todas las aplicaciones actualicen a la \u00faltima versi\u00f3n estable de Electron. Si no es posible realizar la actualizaci\u00f3n, este problema se puede solucionar sin realizar la actualizaci\u00f3n habilitando `sandbox: true` en todos los renderizadores.\n"}], "id": "CVE-2023-23623", "lastModified": "2023-09-11T19:02:53.833", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2023-09-06T21:15:08.977", "references": [{"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/electron/electron/security/advisories/GHSA-gxh7-wv9q-fwfr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-670"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}