Description

Asana Desktop 2.1.0 on macOS allows code injection because of specific Electron Fuses. There is inadequate protection against code injection through settings such as RunAsNode and EnableNodeCliInspectArguments, and thus r3ggi/electroniz3r can be used to perform an attack.

Classification

CVE ID: CVE-2023-49314

CVSS Base Severity: LOW

CVSS Base Score: 0.0

Affected Products

Vendor: n/a

Product: n/a

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.04% (probability of being exploited)

EPSS Percentile: 5.06% (scored less or equal to compared to others)

EPSS Date: 2025-02-03 (when was this score calculated)

References

https://asana.com/pt/download
https://github.com/r3ggi/electroniz3r
https://www.electronjs.org/docs/latest/tutorial/fuses
https://github.com/louiselalanne/CVE-2023-49314
https://github.com/electron/fuses
https://www.electronjs.org/blog/statement-run-as-node-cves

Timeline