by Kastro
Paper/Archive/CVE-2023-46116

CVE-2023-46116

tutao tutanota — Remote Code Execution via insufficiently sanitized call to shell.openExternal

EPSS 1%public exploitCVSS 9.3
critical.is priorityof 100
52
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 69.6.696 × 2013.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Tutanota (Tuta Mail) is an encrypted email provider. Tutanota allows users to open links in emails in external applications. Prior to version 3.118.12, it correctly blocks the `file:` URL scheme, which can be used by malicious actors to gain code execution on a victims computer, however fails to check other harmful schemes such as `ftp:`, `smb:`, etc. which can also be used. Successful exploitation of this vulnerability will enable an attacker to gain code execution on a victim's computer. Version 3.118.2 contains a patch for this issue.

Affected

ProductAffectedFixed inSource
tutanota< 3.118.12–CNA

Scores by source

GitHub_M (CNA)9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refgithub.com/tutao/tutanota/security/advisories/GHSA-mxgj-pq62-f644refgithub.com/tutao/tutanota/commit/88ecad17d00d05a722399aed35f0d280899d55a2refgithub.com/tutao/tutanota/blob/master/src/desktop/ApplicationWindow.ts#L417refgithub.com/tutao/tutanota/blob/master/src/desktop/ApplicationWindow.ts#L423refuser-images.githubusercontent.com/46137338/270564886-7a0389d3-f9ef-44e1-9f5e-57ccc72dcaa8.mp4