CVE-2024-23738 PoC — Postman 安全漏洞

Source

https://github.com/V3x0r/CVE-2024-23738

Associated Vulnerability

Title: Postman 安全漏洞 (CVE-2024-23738)
Description:An issue in Postman version 10.22 and before on macOS allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings. NOTE: the vendor states "we dispute the report's accuracy ... the configuration does not enable remote code execution.."

Description

CVE-2024-23738

Readme

# CVE-2024-23738
 An issue in Postman through 10.22 on macOS allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings.

 There is a tool designed to automate the process of searching for vulnerabilities in electron: https://github.com/r3ggi/electroniz3r
 <img width="1277" alt="image" src="https://github.com/V3x0r/CVE-2024-23738/assets/83291215/19665649-67b9-4e48-90ea-af64a9fe7ed3">
 

 
 With this tool, we can check if the App is Vulnerable:
 
 <img width="710" alt="image" src="https://github.com/V3x0r/CVE-2024-23738/assets/83291215/d2465158-af23-478b-b975-25c1f2bc90ed">
 
 
 After validation, we can inject our code, and get a shell
 
 
 <img width="843" alt="image" src="https://github.com/V3x0r/CVE-2024-23738/assets/83291215/cd658b45-7fdd-4e12-bf75-61a8efb2ff85">


 Enjoy Your Shell :)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →