CVE-2024-23738: Postman RCE Vulnerability on macOS

CVE-2024-23738 Overview

CVE-2024-23738 is a remote code execution vulnerability affecting Postman version 10.22 and earlier on macOS. The vulnerability stems from the RunAsNode and enableNodeClilnspectArguments settings in the Electron-based application, which could potentially allow a remote attacker to execute arbitrary code on vulnerable systems.

It is important to note that the vendor disputes the severity of this vulnerability, stating that "the configuration does not enable remote code execution." However, the CVE has been assigned a critical severity rating, and security researchers have published proof-of-concept demonstrations of the exploitation technique.

Critical Impact

This vulnerability could allow remote attackers to execute arbitrary code on macOS systems running vulnerable versions of Postman, potentially leading to complete system compromise, data theft, or malware installation.

Affected Products

• Postman version 10.22 and earlier
• Postman on macOS platform
• Electron-based Postman application builds

Discovery Timeline

• 2024-01-28 - CVE-2024-23738 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-23738

Vulnerability Analysis

This vulnerability exists in Postman's Electron framework implementation on macOS. Electron applications can be configured with special runtime flags that alter how Node.js operates within the application context. The RunAsNode environment variable, when enabled, causes the Electron application to behave like a standard Node.js runtime rather than a sandboxed Electron app.

When combined with the enableNodeClilnspectArguments setting, attackers may be able to inject arbitrary Node.js inspector arguments or leverage the Node.js runtime capabilities to execute malicious code. This type of vulnerability is part of a broader class of issues affecting Electron-based applications that do not properly restrict these Node.js integration features.

The attack requires the ability to influence the application's launch environment or configuration, which in certain scenarios could be achieved remotely through crafted content or inter-process communication mechanisms.

Root Cause

The root cause of this vulnerability lies in the improper handling of Electron's Node.js integration settings. Specifically, the RunAsNode and enableNodeClilnspectArguments configurations are not adequately restricted, allowing potential abuse of Node.js capabilities that should be sandboxed in the Electron application context.

Electron applications inherit Node.js's powerful system access capabilities, and when these are not properly constrained through fuses or hardened configurations, they can be exploited to bypass the application's intended security boundaries.

Attack Vector

The attack leverages the network-accessible nature of the vulnerability. An attacker could potentially exploit this vulnerability by manipulating the application's runtime environment or through crafted input that triggers the vulnerable code path. The exploitation involves:

1. Setting or leveraging the ELECTRON_RUN_AS_NODE environment variable
2. Exploiting the enableNodeCliInspectArguments setting to inject debugging parameters
3. Utilizing the exposed Node.js runtime to execute arbitrary JavaScript code with full system access

For detailed technical information on the exploitation technique, refer to the GitHub PoC Repository. The Electron project has also published a statement regarding this class of vulnerabilities in their official blog post.

Detection Methods for CVE-2024-23738

Indicators of Compromise

• Unusual environment variables set when launching Postman (particularly ELECTRON_RUN_AS_NODE=1)
• Postman processes spawning unexpected child processes or network connections
• Modified Postman application bundles or Info.plist configurations on macOS
• Presence of Node.js inspector ports listening on unexpected interfaces

Detection Strategies

• Monitor for the ELECTRON_RUN_AS_NODE environment variable being set when Postman launches
• Implement endpoint detection rules that flag Electron applications spawning command shells or scripting interpreters
• Deploy file integrity monitoring on Postman application directories to detect tampering
• Use process monitoring to identify Postman processes with unusual command-line arguments

Monitoring Recommendations

• Enable detailed process creation logging on macOS endpoints using tools like SentinelOne or osquery
• Configure alerts for Postman processes that establish unexpected outbound network connections
• Monitor for debugging ports (typically 9229) being opened by Postman or related processes
• Implement behavioral analysis to detect code execution patterns inconsistent with normal Postman operations

How to Mitigate CVE-2024-23738

Immediate Actions Required

• Upgrade Postman to the latest available version beyond 10.22
• Review and restrict which applications can modify environment variables on protected endpoints
• Implement application control policies to prevent unauthorized modifications to Postman
• Consider using network segmentation to limit the exposure of workstations running Postman

Patch Information

Users should update to the latest version of Postman available from the official Postman website. While the vendor disputes the remote code execution aspect of this vulnerability, updating to the latest version is recommended to ensure all security improvements are applied.

Review the Electron Blog Statement for additional context on how Electron addresses this class of vulnerabilities and recommended hardening measures for Electron applications.

Workarounds

• Block or monitor for the ELECTRON_RUN_AS_NODE environment variable using endpoint security tools
• Restrict write access to Postman application directories and configuration files
• Consider using alternative API development tools if Postman cannot be updated immediately
• Implement strict application allowlisting policies that detect modified Electron applications

# Check for vulnerable Postman version on macOS
/Applications/Postman.app/Contents/MacOS/Postman --version

# Monitor for suspicious environment variables
env | grep -i electron

# Check for active Node.js inspector ports
lsof -i :9229 -P -n