CVE-2023-22524: RCE Vulnerability in Atlassian Companion for macOS

TL;DR This blog unveils a remote code execution vulnerability, identified as CVE-2023-22524, in Atlassian Companion for macOS, which has recently been patched. This critical vulnerability stemmed from an ability to bypass both the apps blocklist and macOS Gatekeeper, potentially allowing the...

Exploit for CVE-2023-22524

Atlassian Companion RCE Vulnerability Proof of Concept CVE-20...

Exploit for CVE-2023-22524

Atlassian Companion RCE Vulnerability Proof of Concept CVE-20...

CVE-2023-22524

Certain versions of the Atlassian Companion App for MacOS were affected by a remote code execution vulnerability. An attacker could utilize WebSockets to bypass Atlassian Companion’s blocklist and MacOS Gatekeeper to allow execution of code...

CVE-2023-22524

Certain versions of the Atlassian Companion App for MacOS were affected by a remote code execution vulnerability. An attacker could utilize WebSockets to bypass Atlassian Companion’s blocklist and MacOS Gatekeeper to allow execution of code...

CVE-2023-22524

Certain versions of the Atlassian Companion App for MacOS were affected by a remote code execution vulnerability. An attacker could utilize WebSockets to bypass Atlassian Companion’s blocklist and MacOS Gatekeeper to allow execution of code...

Remote code execution

Certain versions of the Atlassian Companion App for MacOS were affected by a remote code execution vulnerability. An attacker could utilize WebSockets to bypass Atlassian Companion’s blocklist and MacOS Gatekeeper to allow execution of code...

CVE-2023-22524

CVE-2023-22524 describes a remote code execution in the Atlassian Companion App for macOS. The issue arises from how the app handles certain file types and its WebSocket-based communication, allowing an attacker to bypass the app’s blocklist and macOS Gatekeeper, potentially enabling arbitrary co...

CVE-2023-22524

Certain versions of the Atlassian Companion App for MacOS were affected by a remote code execution vulnerability. An attacker could utilize WebSockets to bypass Atlassian Companion’s blocklist and MacOS Gatekeeper to allow execution of code...

CVE-2023-22524: Undefined Security Weakness

Certain versions of the Atlassian Companion App for MacOS were affected by a remote code execution vulnerability. An attacker could utilize WebSockets to bypass Atlassian Companion’s blocklist and MacOS Gatekeeper to allow execution of code...

PT-2023-7590 · Atlassian · Companion App

Name of the Vulnerable Software and Affected Versions: Atlassian Companion App for MacOS affected versions not specified Description: The issue is related to a remote code execution vulnerability in the Atlassian Companion App for MacOS. An attacker could utilize WebSockets to bypass Atlassian...

Compromised minter can change route to misdirect user funds

Lines of code Vulnerability details Impact The current security assumption revolves around the compromise of a minter, wherein they mint 200k USDe tokens for themselves and subsequently redeem them within the contract. Under this assumption, as long as the gatekeeper key remains secure, the minte...

Minter can censor GATEKEEPER and mint uncollateralized for a prolonged period of time

Lines of code Vulnerability details Impact Ethena explicitly mentions their protection against a compromised minter, the mentioned maximum loss is $100.000. The protection against a compromised minter rests on the GATEKEEPER role which is a system running on AWS set to remove the minter if mints...

Wrong estimation of acceptable risk of the protocol losses

Lines of code Vulnerability details Impact The protocol losses in case compromised MINTERS or REDEEMERS can be higher than expected due to the GATEKEEPER suppression. Attacker can frontrun the GATEKEEPER and fill block limit with own transactions while it is profitable. Average losses can be more...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: plutono-fips, aws-efs-csi-driver-fips, kubeflow, buildkitd, kubescape, terraform-provider-sendgrid, vault-csi-provider, prometheus-blackbox-exporter, bank-vaults-fips, kubevela, prometheus-adapter-fips, kubernetes-csi-livenessprobe-fips, kiam, kube-oidc-proxy,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: kubevela, aactl, up, cortex, k3d, spark-operator, slsa-verifier, scorecard, buildkitd, dgraph, kubeflow, src, terraform-provider-sendgrid, kubescape...

GHSA-RCJV-MGP8-QVMR vulnerabilities

Vulnerabilities for packages: metrics-server-fips, kubevela, kubernetes, caddy, kube-oidc-proxy, buildkitd, kubernetes-fips, k3s, rancher-webhook, prometheus-adapter, rancher-webhook-fips, up...

CVE-2023-45142 vulnerabilities

Vulnerabilities for packages: kubevela, up, caddy, k3s, prometheus-adapter, buildkitd, kubernetes...

CVE-2023-45142 vulnerabilities

Vulnerabilities for packages: metrics-server-fips, kubevela, kubernetes, caddy, kube-oidc-proxy, buildkitd, kubernetes-fips, k3s, rancher-webhook, prometheus-adapter, rancher-webhook-fips, up...

GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: flux-image-automation-controller, bom, metrics-server, prometheus-node-exporter-fips, flux, prometheus-postgres-exporter-fips, pulumi-language-java, node-problem-detector, kaf, kubernetes-csi-external-provisioner, crossplane-provider-aws, kube-oidc-proxy,...