CVE-2023-50975
📋 TL;DR
This vulnerability in TD Bank's TD Advanced Dashboard client for macOS allows arbitrary code execution because the application doesn't disable the ELECTRON_RUN_AS_NODE environment variable in production builds. This enables attackers to execute arbitrary Node.js code within the application context, potentially accessing sensitive banking information. Only macOS users of the TD Advanced Dashboard client are affected.
💻 Affected Systems
- TD Bank TD Advanced Dashboard client
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of banking information including account credentials, transaction history, and personal data through arbitrary code execution within the banking application context.
Likely Case
Local privilege escalation leading to unauthorized access to banking data stored or processed by the application.
If Mitigated
Limited impact if application runs with minimal privileges and proper sandboxing, though code execution would still be possible.
🎯 Exploit Status
Exploitation requires local access to the target system. The vulnerability is well-documented with public proof-of-concept available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 3.0.4 or later
Vendor Advisory: https://www.electronjs.org/blog/statement-run-as-node-cves
Restart Required: Yes
Instructions:
1. Check current version of TD Advanced Dashboard. 2. Update to version 3.0.4 or later through the application's update mechanism or download from official TD Bank sources. 3. Restart the application.
🔧 Temporary Workarounds
Disable ELECTRON_RUN_AS_NODE
allSet the ELECTRON_RUN_AS_NODE environment variable to 0 to prevent exploitation
export ELECTRON_RUN_AS_NODE=0
Application Sandboxing
allRun the application in a sandboxed environment to limit potential damage
🧯 If You Can't Patch
- Restrict application execution to users with minimal privileges
- Monitor for unusual process activity or network connections from the TD Advanced Dashboard application
🔍 How to Verify
Check if Vulnerable:
Check if TD Advanced Dashboard version is 3.0.3 or earlier on macOSCheck Version:
Check application 'About' section or run: /Applications/TD\ Advanced\ Dashboard.app/Contents/MacOS/TD\ Advanced\ Dashboard --versionVerify Fix Applied:
Verify TD Advanced Dashboard version is 3.0.4 or later📡 Detection & Monitoring
Log Indicators:
- Unusual process spawns from TD Advanced Dashboard
- Node.js processes running with TD Advanced Dashboard privileges
Network Indicators:
- Unexpected network connections from TD Advanced Dashboard process
SIEM Query:
process_name:"TD Advanced Dashboard" AND (process_cmdline:"node" OR process_cmdline:"ELECTRON_RUN_AS_NODE")🔗 References
- https://gist.github.com/khronokernel/2598c067d0f49b0f0a4c8b01cf129d34
- https://newsroom.ripeda.com/tag/macs-for-business/
- https://www.electronjs.org/blog/statement-run-as-node-cves
- https://gist.github.com/khronokernel/2598c067d0f49b0f0a4c8b01cf129d34
- https://newsroom.ripeda.com/tag/macs-for-business/
- https://www.electronjs.org/blog/statement-run-as-node-cves
