CVE-2024-23746

CVE-2024-23746 macOS 上的 Miro Desktop 0.8.18 存在 Electron 代码注入漏洞。 PoC 签名和版本： 用于探索漏洞的工具： https://github.com/r3ggi/electroniz3r 验证是否存在漏洞： 注入盲壳： 参考 https://book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-dirty-nib https://www.notion.so/web-clipper...

EUVD-2024-21202

Malicious code in bioql PyPI...

CVE-2024-23746

Miro Desktop 0.8.18 on macOS allows local Electron code injection via a complex series of steps that might be usable in some environments bypass a kTCCServiceSystemPolicyAppBundles requirement via a file copy, an app.app/Contents rename, an asar modification, and a rename back to app.app/Contents...

CVE-2024-23746

Miro Desktop 0.8.18 on macOS allows local Electron code injection via a complex series of steps that might be usable in some environments bypass a kTCCServiceSystemPolicyAppBundles requirement via a file copy, an app.app/Contents rename, an asar modification, and a rename back to app.app/Contents...

CVE-2024-23746

Miro Desktop 0.8.18 on macOS allows local Electron code injection via a complex series of steps that might be usable in some environments bypass a kTCCServiceSystemPolicyAppBundles requirement via a file copy, an app.app/Contents rename, an asar modification, and a rename back to app.app/Contents...

Code injection

Miro Desktop 0.8.18 on macOS allows code injection via a complex series of steps that might be usable in some environments bypass a kTCCServiceSystemPolicyAppBundles requirement via a file copy, an app.app/Contents rename, an asar modification, and a rename back to app.app/Contents...

Miro Desktop Code Injection Vulnerability

Miro Desktop is a desktop application for team collaboration and remote work from Miro. A code injection vulnerability exists in Miro Desktop version 0.8.18 that stems from allowing Electron code injection...

CVE-2024-23746

Miro Desktop 0.8.18 on macOS allows local Electron code injection via a complex series of steps that might be usable in some environments bypass a kTCCServiceSystemPolicyAppBundles requirement via a file copy, an app.app/Contents rename, an asar modification, and a rename back to app.app/Contents...

CVE-2024-23746

CVE-2024-23746 (Miro Desktop 0.8.18 on macOS) : Local Electron code injection is possible through a multi-step bypass of kTCCServiceSystemPolicyAppBundles (including a file copy, app.app/Contents rename, an asar modification, then a final rename). This is described across multiple sources as enab...

PT-2024-1419 · Miro · Miro Desktop

Name of the Vulnerable Software and Affected Versions: Miro Desktop version 0.8.18 Description: The issue is related to incorrect code generation management in the Miro digital collaboration platform on macOS, which may allow a remote attacker to execute arbitrary code. The exploitation involves ...