Vulnerability · Published Dec 15, 2023 · Assigned by GitHub_M

CVE-2023-46116Remote Code Execution via insufficiently sanitized call to shell.openExternal

Critical 9.3

In plain English

A critical-severity improper input validation in tutanota from tutao. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities).

Severity (CVSS 3.1)9.3Critical

Exploit odds (30 days)1.3%top 30.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Tutanota (Tuta Mail) is an encrypted email provider. Tutanota allows users to open links in emails in external applications. Prior to version 3.118.12, it correctly blocks the `file:` URL scheme, which can be used by malicious actors to gain code execution on a victims computer, however fails to check other harmful schemes such as `ftp:`, `smb:`, etc. which can also be used. Successful exploitation of this vulnerability will enable an attacker to gain code execution on a victim's computer. Version 3.118.2 contains a patch for this issue.

Affected products (as reported)

Vendor	Product	Versions
tutao	tutanota	< 3.118.12

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

References

https://github.com/tutao/tutanota/security/advisories/GHSA-mxgj-pq62-f644 x_refsource_CONFIRM
https://github.com/tutao/tutanota/commit/88ecad17d00d05a722399aed35f0d280899d55a2 x_refsource_MISC
https://github.com/tutao/tutanota/blob/master/src/desktop/ApplicationWindow.ts#L417 x_refsource_MISC
https://github.com/tutao/tutanota/blob/master/src/desktop/ApplicationWindow.ts#L423 x_refsource_MISC
https://user-images.githubusercontent.com/46137338/270564886-7a0389d3-f9ef-44e1-9f5e-57ccc72dcaa8.mp4 x_refsource_MISC