CVE-2024-23742
📋 TL;DR
This vulnerability in Loom on macOS allows remote attackers to execute arbitrary code by exploiting the RunAsNode and enableNodeCliInspectArguments settings. The vendor disputes the remote aspect, stating it requires local access to a victim's machine. Affected users are those running Loom version 0.196.1 or earlier on macOS.
💻 Affected Systems
- Loom
📦 What is this software?
Loom by Loom
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with remote code execution leading to data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Local privilege escalation or code execution if an attacker gains initial access to the system, potentially leading to lateral movement within the network.
If Mitigated
Limited impact with proper application sandboxing, network segmentation, and least privilege principles in place.
🎯 Exploit Status
Exploitation requires local access according to vendor, but public PoC exists. The dispute centers on whether remote exploitation is feasible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.196.2 or later
Vendor Advisory: https://www.electronjs.org/blog/statement-run-as-node-cves
Restart Required: Yes
Instructions:
1. Update Loom to version 0.196.2 or later. 2. Restart the application. 3. Verify the update was successful.
🔧 Temporary Workarounds
Disable vulnerable settings
allDisable RunAsNode and enableNodeCliInspectArguments settings in Loom configuration.
Check Loom settings and ensure these options are disabled
🧯 If You Can't Patch
- Restrict application execution to trusted users only.
- Implement application sandboxing or containerization to limit potential damage.
🔍 How to Verify
Check if Vulnerable:
Check Loom version in application settings or About menu. If version is 0.196.1 or earlier, the system is vulnerable.Check Version:
Open Loom, go to About Loom in the menu to see version.Verify Fix Applied:
Confirm Loom version is 0.196.2 or later in application settings.📡 Detection & Monitoring
Log Indicators:
- Unusual process execution from Loom, unexpected network connections from Loom process
Network Indicators:
- Suspicious outbound connections from Loom to unknown IPs
SIEM Query:
Process creation where parent process is Loom and command line contains suspicious arguments