Windows Livebook Arbitrary Code Execution Vulnerability

Windows Livebook Arbitrary Code Execution Vulnerability

Livebook is a web application for writing interactive and collaborative code notebooks.

According to the vulnerability report released on 29th of June; On Windows, it is possible to open a `livebook://` link from a browser which opens Livebook Desktop and triggers arbitrary code execution on victim's machine. Anyone who is using Livebook Desktop on Windows is potentially vulnerable to arbitrary code execution when they expect Livebook to be opened from browser. This vulnerability has been fixed in version 0.8.2 and 0.9.3. (CVE-2023-35174)

Affected Systems

Configuration 1
cpe:2.3:a:livebook:livebook:*:*:*:*:*:*:*:*From (including) 0.8.0 Up to (excluding) 0.8.2
cpe:2.3:a:livebook:livebook:*:*:*:*:*:*:*:*From (including) 0.9.0 Up to (excluding) 0.9.3


Running on/with
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

IoC’s

-

Recommended Solution(s)

-

Mitigations

-

CVE / CWE

CVE-2023-35174

Related Website(s)

• https://nvd.nist.gov/vuln/detail/CVE-2023-35174
• https://github.com/livebook-dev/livebook/commit/2e11b59f677c6ed3b6aa82dad412a8b3406ffdf1
• https://github.com/livebook-dev/livebook/commit/beb10daaadcc765f0380e436bd7cd5f74cf086c8
• https://github.com/livebook-dev/livebook/releases/tag/v0.8.2
• https://github.com/livebook-dev/livebook/releases/tag/v0.9.3
• https://github.com/livebook-dev/livebook/security/advisories/GHSA-564w-97r7-c6p9

* Vulnerabilities with a CVSS 3.1 score between 7.0 and 8.9 are evaluated to be “high” whereas vulnerabilities with a CVSS 3.1 score between 9.0 and 10.0 are evaluated to be “critical”.