CVE-2023-35174: Livebook Desktop's protocol handler can be exploited to execute arbitrary command on Windows
Livebook is a web application for writing interactive and collaborative code notebooks. On Windows, it is possible to open a livebook:// link from a browser which opens Livebook Desktop and triggers arbitrary code execution on victim's machine. Any user using Livebook Desktop on Windows is potentially vulnerable to arbitrary code execution when they expect Livebook to be opened from browser. This vulnerability has been fixed in version 0.8.2 and 0.9.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
erlang/livebookto a version that resolves this vulnerability.Fixed in 0.9.3 - Upgrade
Upgrade
erlang/livebookto a version that resolves this vulnerability.Fixed in 0.8.2 - Upgrade
Upgrade
Livebook Desktopto a version that resolves this vulnerability.Fixed in 0.8.2 - Upgrade
Upgrade
Livebook Desktopto a version that resolves this vulnerability.Fixed in 0.9.3
Event History
Frequently Asked Questions
What is the severity of CVE-2023-35174?
CVE-2023-35174 has been classified as a high severity vulnerability due to its potential for arbitrary code execution.
How can I mitigate CVE-2023-35174?
To mitigate CVE-2023-35174, ensure you update Livebook to version 0.9.3 or later, or 0.8.2 or later.
What is the impact of CVE-2023-35174 on my system?
The impact of CVE-2023-35174 allows an attacker to execute arbitrary code on the victim's machine through specially crafted livebook:// links.
Are specific versions of Livebook affected by CVE-2023-35174?
Yes, Livebook versions between 0.8.0 to 0.8.2 and 0.9.0 to 0.9.3 are affected by CVE-2023-35174.
Can CVE-2023-35174 affect users on operating systems other than Windows?
CVE-2023-35174 primarily affects users on Windows, and other operating systems are not directly impacted.