CVE-2024-23746
Severity CVSS v4.0:
Pending analysis
Type:
CWE-94
Code Injection
Publication date:
02/02/2024
Last modified:
04/06/2025
Description
Miro Desktop 0.8.18 on macOS allows local Electron code injection via a complex series of steps that might be usable in some environments (bypass a kTCCServiceSystemPolicyAppBundles requirement via a file copy, an app.app/Contents rename, an asar modification, and a rename back to app.app/Contents).
Impact
Base Score 3.x
9.80
Severity 3.x
CRITICAL
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:miro:miro:0.8.18:*:*:*:*:*:*:* | ||
| cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- https://book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-electron-applications-injection
- https://github.com/louiselalanne/CVE-2024-23746
- https://miro.com/about/
- https://www.electronjs.org/blog/statement-run-as-node-cves
- https://book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-electron-applications-injection
- https://github.com/louiselalanne/CVE-2024-23746
- https://miro.com/about/
- https://www.electronjs.org/blog/statement-run-as-node-cves