CVE-2023-35174: Arbitrary Command Execution in Livebook Desktop
Summary
CVE-2023-35174: Livebook Desktop's protocol handler can be exploited to execute arbitrary command on Windows. Affects livebook across 2 version ranges.
>= 0.8.0, < 0.8.2
>= 0.9.0, < 0.9.3
Fixed in 0.8.2 or 0.9.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Livebook Desktop is an open-source application that allows users to interact with notebooks and code in a collaborative environment. It provides a protocol handler that enables users to open livebook:// links from a browser. This functionality is intended to seamlessly integrate Livebook Desktop with web browsers on Windows. However, a vulnerability in the protocol handler allows for the execution of arbitrary commands on the victim's machine.
Vulnerability Detail
The vulnerability arises from the ability to open livebook:// links from a browser, which triggers the execution of arbitrary code on the victim's machine. This means that any user of Livebook Desktop on Windows is potentially vulnerable to arbitrary code execution when they expect Livebook to be opened from a browser. The impact of this vulnerability can be severe, as an attacker could exploit it to execute malicious commands, potentially leading to unauthorized access, data loss, or other malicious activities.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 0.8.0, < 0.8.20.8.2 -
>= 0.9.0, < 0.9.30.9.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can disable the protocol handler for livebook:// links in their web browsers. This can be done by modifying the browser settings or using browser extensions that allow for the blocking of specific protocols. By disabling the protocol handler, users can mitigate the risk of arbitrary code execution until they can update to a patched version of Livebook Desktop.
Conclusion
The vulnerability in Livebook Desktop's protocol handler exposes users to the risk of arbitrary code execution. It is crucial for users to update their installations to the patched versions mentioned above to mitigate this vulnerability. Additionally, users can temporarily disable the protocol handler as a workaround until they can apply the updates. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for livebook →
FAQ
Livebook Desktop is an open-source application that provides a collaborative environment for working with notebooks and code.
The vulnerability allows for the execution of arbitrary commands on a user's machine, which can lead to unauthorized access, data loss, or other malicious activities.
Yes, any user of Livebook Desktop on Windows is potentially vulnerable to the arbitrary code execution vulnerability when opening livebook:// links from a browser.
Users should update their Livebook Desktop installation to version 0.8.2 or higher (for versions 0.8.0 to 0.8.1) or version 0.9.3 or higher (for versions 0.9.0 to 0.9.2) to address the vulnerability.
Yes, users can temporarily disable the protocol handler for livebook:// links in their web browsers to mitigate the risk of arbitrary code execution.
References
Related vulnerabilities
Recent vulnerabilities recorded for livebook.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
