CVE-2024-39331
📋 TL;DR
This vulnerability in Emacs Org Mode allows arbitrary code execution when processing malicious Org documents containing specially crafted link abbreviations. Attackers can execute shell commands with the privileges of the user opening the document. Affects Emacs users with Org Mode enabled who open untrusted Org files.
💻 Affected Systems
- GNU Emacs with Org Mode
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via remote code execution when user opens a malicious Org document, leading to data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Local privilege escalation or arbitrary command execution when users open Org files from untrusted sources, potentially leading to credential theft or lateral movement.
If Mitigated
Limited impact if users only open trusted Org files and have proper file validation controls in place.
🎯 Exploit Status
Exploitation requires user interaction (opening a malicious Org file) but the vulnerability is straightforward to exploit once the malicious file is crafted.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Emacs 29.4 or Org Mode 9.7.5
Vendor Advisory: https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29
Restart Required: Yes
Instructions:
1. Update Emacs to version 29.4 or later using your package manager. 2. Alternatively, update Org Mode to version 9.7.5 or later. 3. Restart Emacs after updating.
🔧 Temporary Workarounds
Disable unsafe link abbreviation expansion
allAdd configuration to prevent expansion of unsafe functions in link abbreviations
Add to .emacs: (setq org-link-abbrev-alist nil)
Disable Org Mode link abbreviation feature
allCompletely disable the vulnerable link abbreviation functionality
Add to .emacs: (setq org-link-use-abbrev-for-name nil)
🧯 If You Can't Patch
- Only open Org files from trusted sources and avoid downloading Org files from untrusted locations
- Use Emacs in a sandboxed environment or container when handling potentially untrusted Org files
🔍 How to Verify
Check if Vulnerable:
Check Emacs version with: emacs --version | head -1. Check Org Mode version by opening Emacs and running: M-x org-versionCheck Version:
emacs --version | head -1Verify Fix Applied:
Verify Emacs version is 29.4+ or Org Mode version is 9.7.5+. Test with a safe %(shell-command-to-string "echo test") link abbreviation - it should not execute.📡 Detection & Monitoring
Log Indicators:
- Unusual shell command execution from Emacs process
- Emacs process spawning unexpected child processes
Network Indicators:
- Emacs process making unexpected network connections
SIEM Query:
process.name:"emacs" AND process.parent.name NOT IN ["bash", "zsh", "terminal"] AND process.cmdline CONTAINS "shell-command"🔗 References
- https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29
- https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=f4cc61636947b5c2f0afc67174dd369fe3277aa8
- https://list.orgmode.org/87sex5gdqc.fsf%40localhost/
- https://lists.debian.org/debian-lts-announce/2024/06/msg00023.html
- https://lists.debian.org/debian-lts-announce/2024/06/msg00024.html
- https://lists.gnu.org/archive/html/info-gnu-emacs/2024-06/msg00000.html
- https://news.ycombinator.com/item?id=40768225
- https://www.openwall.com/lists/oss-security/2024/06/23/1
- https://www.openwall.com/lists/oss-security/2024/06/23/2
- https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29
- https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=f4cc61636947b5c2f0afc67174dd369fe3277aa8
- https://list.orgmode.org/87sex5gdqc.fsf%40localhost/
- https://lists.debian.org/debian-lts-announce/2024/06/msg00023.html
- https://lists.debian.org/debian-lts-announce/2024/06/msg00024.html
- https://lists.gnu.org/archive/html/info-gnu-emacs/2024-06/msg00000.html
- https://news.ycombinator.com/item?id=40768225
- https://www.openwall.com/lists/oss-security/2024/06/23/1
- https://www.openwall.com/lists/oss-security/2024/06/23/2
