critical
9.8
CWE
670
Advisory Published
CVE Published
Updated

CVE-2023-23623: Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled in Electron

First published: Wed Sep 06 2023(Updated: )

### Impact A Content-Security-Policy that disables eval, specifically setting a `script-src` directive and _not_ providing `unsafe-eval` in that directive, is not respected in renderers that have sandbox and contextIsolation disabled. i.e. `sandbox: false` and `contextIsolation: false` in the `webPreferences` object. This resulted in incorrectly allowing usage of methods like `eval()` and `new Function`, which can result in an expanded attack surface. ### Patches This issue only ever affected the 22 and 23 major versions of Electron and has been fixed in the latest versions of those release lines. Specifically, these versions contain the fixes: - 22.0.1 - 23.0.0-alpha.2 We recommend all apps upgrade to the latest stable version of Electron, especially if they use `sandbox: false` or `contextIsolation: false`. ### Workarounds If upgrading isn't possible, this issue can be addressed without upgrading by enabling at least one of `sandbox: true` or `contextIsolation: true` on all renderers. ```js const mainWindow = new BrowserWindow({ webPreferences: { sandbox: true, } }); ``` ### For more information If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org). ### Credit Thanks to user @andreasdj for reporting this issue.

Credit: security-advisories@github.com security-advisories@github.com security-advisories@github.com

Affected SoftwareAffected VersionHow to fix
Electronjs Electron=22.0.0
Electronjs Electron=22.0.0-beta1
Electronjs Electron=22.0.0-beta2
Electronjs Electron=22.0.0-beta3
Electronjs Electron=22.0.0-beta4
Electronjs Electron=22.0.0-beta5
Electronjs Electron=22.0.0-beta6
Electronjs Electron=22.0.0-beta7
Electronjs Electron=22.0.0-beta8
Electronjs Electron=23.0.0-alpha1

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the impact of CVE-2023-23623?

    The impact of CVE-2023-23623 is the bypassing of Content-Security-Policy restrictions in renderers that have sandbox and contextIsolation disabled.

  • How can I fix CVE-2023-23623?

    To fix CVE-2023-23623, you should update Electron to version 23.0.0-alpha.2 or apply the recommended patches.

  • What is the severity of CVE-2023-23623?

    The severity of CVE-2023-23623 is critical with a CVSS score of 9.8.

  • Where can I find more information about CVE-2023-23623?

    You can find more information about CVE-2023-23623 on the official Electron GitHub security advisory page.

  • What is the CWE ID for CVE-2023-23623?

    The CWE ID for CVE-2023-23623 is CWE-670.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203