CVE-2023-46116
Remote Code Execution via insufficiently sanitized call to shell.openExternal
- State
- Published
- Severity
- 9.3 Critical
- Published
- Dec 15, 2023
- Updated
- Oct 8, 2024
- Reserved
- Oct 16, 2023
Description
Tutanota (Tuta Mail) is an encrypted email provider. Tutanota allows users to open links in emails in external applications. Prior to version 3.118.12, it correctly blocks the `file:` URL scheme, which can be used by malicious actors to gain code execution on a victims computer, however fails to check other harmful schemes such as `ftp:`, `smb:`, etc. which can also be used. Successful exploitation of this vulnerability will enable an attacker to gain code execution on a victim's computer. Version 3.118.2 contains a patch for this issue.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.3 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N | GitHub_M |
Weaknesses
- CWE-20 Improper Input Validation
Affected Products
| Product | Versions |
|---|---|
tutanotatutao |
|
References
- https://github.com/tutao/tutanota/security/advisories/GHSA-mxgj-pq62-f644
- https://github.com/tutao/tutanota/commit/88ecad17d00d05a722399aed35f0d280899d55a2
- https://github.com/tutao/tutanota/blob/master/src/desktop/ApplicationWindow.ts#L417
- https://github.com/tutao/tutanota/blob/master/src/desktop/ApplicationWindow.ts#L423
- https://user-images.githubusercontent.com/46137338/270564886-7a0389d3-f9ef-44e1-9f5e-57ccc72dcaa8.mp4
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.