Remote Code Execution via insufficiently sanitized call to shell.openExternal
Vulnerability Description
Tutanota (Tuta Mail) is an encrypted email provider. Tutanota allows users to open links in emails in external applications. Prior to version 3.118.12, it correctly blocks the `file:` URL scheme, which can be used by malicious actors to gain code execution on a victims computer, however fails to check other harmful schemes such as `ftp:`, `smb:`, etc. which can also be used. Successful exploitation of this vulnerability will enable an attacker to gain code execution on a victim's computer. Version 3.118.2 contains a patch for this issue.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-46116
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/tutao/tutanota/security/advisories/GHSA-mxgj-pq62-f644
- https://github.com/tutao/tutanota/commit/88ecad17d00d05a722399aed35f0d280899d55a2
- https://github.com/tutao/tutanota/blob/master/src/desktop/ApplicationWindow.ts#L417
- https://github.com/tutao/tutanota/blob/master/src/desktop/ApplicationWindow.ts#L423
- https://user-images.githubusercontent.com/46137338/270564886-7a0389d3-f9ef-44e1-9f5e-57ccc72dcaa8.mp4
Affected Vendor
tutao
View all reports →