CVE-2024-23742: Loom macOS RCE Vulnerability

CVE-2024-23742 Overview

CVE-2024-23742 is a code injection vulnerability affecting Loom for macOS version 0.196.1 and earlier. The vulnerability allows attackers to execute arbitrary code by exploiting the RunAsNode and enableNodeCliInspectArguments settings in the Electron-based application. This is a well-documented class of vulnerabilities affecting Electron applications that do not properly restrict these Node.js runtime features.

Critical Impact

Successful exploitation enables arbitrary code execution on macOS systems running vulnerable versions of Loom, potentially leading to complete system compromise.

Affected Products

• Loom for macOS version 0.196.1 and earlier
• All Electron-based Loom installations on macOS prior to patch

Discovery Timeline

• 2024-01-28 - CVE-2024-23742 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-23742

Vulnerability Analysis

This vulnerability stems from improper configuration of Electron framework settings within the Loom application. Electron applications that do not disable the ELECTRON_RUN_AS_NODE environment variable and Node.js CLI inspect arguments allow attackers to abuse these features to execute arbitrary JavaScript code outside the application's sandboxed context.

When ELECTRON_RUN_AS_NODE is enabled, the Electron binary can be invoked to run as a standard Node.js process, bypassing application-level security restrictions. Combined with inspector arguments, this creates a pathway for code injection attacks.

It should be noted that the vendor disputes this vulnerability, stating that exploitation requires local access to a victim's machine. The Electron Blog CVE Statement provides additional context on this class of vulnerabilities and their exploitation prerequisites.

Root Cause

The root cause is insufficient hardening of Electron runtime configuration. The Loom application fails to disable dangerous Node.js integration features that should be restricted in production deployments. Specifically, the application does not set ELECTRON_RUN_AS_NODE=0 as an environment restriction or properly disable --inspect and related debugging flags.

Attack Vector

The attack exploits the Electron framework's ability to run as a standard Node.js interpreter. An attacker can set the ELECTRON_RUN_AS_NODE environment variable and pass malicious scripts or inspector arguments to the Loom application binary. This effectively transforms the signed Electron application into an arbitrary code execution engine, potentially bypassing macOS Gatekeeper and security policies since the application is legitimately signed.

The attack flow involves:

1. Setting the ELECTRON_RUN_AS_NODE=1 environment variable
2. Invoking the Loom binary with Node.js CLI arguments
3. Executing arbitrary JavaScript code with the privileges of the Loom application

A proof-of-concept demonstrating this vulnerability is available at the GitHub PoC Repository.

Detection Methods for CVE-2024-23742

Indicators of Compromise

• Unexpected environment variable ELECTRON_RUN_AS_NODE set to 1 on systems running Loom
• Loom process spawned with unusual command-line arguments such as --inspect, --inspect-brk, or JavaScript file paths
• Anomalous child processes spawned by the Loom application binary

Detection Strategies

• Monitor process creation events for Loom binary executions with Node.js-specific CLI arguments
• Implement endpoint detection rules to alert on ELECTRON_RUN_AS_NODE environment variable manipulation
• Track network connections initiated by Loom processes that deviate from expected communication patterns
• Deploy behavioral analysis to detect code injection patterns in Electron applications

Monitoring Recommendations

• Enable detailed process auditing on macOS endpoints running Loom
• Configure SIEM rules to correlate environment variable changes with application launches
• Implement file integrity monitoring for Loom application bundles to detect tampering
• Review application logs for unexpected Node.js debugging session initiation

How to Mitigate CVE-2024-23742

Immediate Actions Required

• Update Loom to the latest available version that addresses this vulnerability
• Audit systems for signs of exploitation using the indicators of compromise listed above
• Restrict user permissions to prevent unauthorized environment variable modifications
• Consider temporary application removal on high-value systems until patched versions are deployed

Patch Information

Users should update to the latest version of Loom for macOS that addresses this Electron configuration vulnerability. Check the official Loom download page for updated releases. For additional context on how Electron-based applications should handle these CVEs, refer to the Electron Blog CVE Statement.

Workarounds

• Implement application allowlisting to prevent Loom execution with non-standard arguments
• Use macOS configuration profiles to restrict environment variable manipulation for the Loom application
• Deploy endpoint protection solutions capable of detecting Electron abuse patterns
• Consider using SentinelOne's behavioral AI to detect anomalous code execution from Electron applications

# Verify Loom version on macOS
/Applications/Loom.app/Contents/MacOS/Loom --version

# Check for suspicious environment variables in running processes
ps eww | grep -i loom | grep ELECTRON_RUN_AS_NODE