Skip to main content
A Leader in the 2026 Gartner® Magic Quadrant™ for Endpoint Protection. Six years running.Find Out Why
Vulnerability Database/CVE-2024-23746

CVE-2024-23746: Miro Desktop RCE Vulnerability

CVE-2024-23746 is a remote code execution flaw in Miro Desktop for macOS that enables local Electron code injection through bundle manipulation. This article covers technical details, affected versions, and mitigations.

Published:

CVE-2024-23746 Overview

CVE-2024-23746 is a critical Code Injection vulnerability affecting Miro Desktop version 0.8.18 on macOS. The vulnerability allows local attackers to inject malicious Electron code through a complex multi-step exploitation process that bypasses macOS security controls. Specifically, the attack circumvents the kTCCServiceSystemPolicyAppBundles requirement through a series of file system manipulations involving file copying, directory renaming, ASAR archive modification, and subsequent restoration of the original directory structure.

This vulnerability is classified under CWE-94 (Improper Control of Generation of Code), indicating that the application fails to properly validate or sanitize code that is dynamically generated or executed within the Electron framework.

Critical Impact

Successful exploitation enables attackers to execute arbitrary code within the context of the Miro Desktop application, potentially leading to complete compromise of user data, credential theft, and persistent access to the affected macOS system.

Affected Products

  • Miro Desktop version 0.8.18 on macOS
  • Apple macOS (as the underlying platform)

Discovery Timeline

  • 2024-02-02 - CVE-2024-23746 published to NVD
  • 2025-06-04 - Last updated in NVD database

Technical Details for CVE-2024-23746

Vulnerability Analysis

The vulnerability exploits weaknesses in how Miro Desktop handles its Electron application bundle on macOS. Electron applications package their source code in ASAR (Atom Shell Archive) archives, which can be extracted, modified, and repackaged if proper protections are not in place.

The attack leverages the Transparency, Consent, and Control (TCC) framework bypass on macOS. The kTCCServiceSystemPolicyAppBundles protection normally prevents unauthorized modifications to application bundles. However, by performing a specific sequence of file system operations—copying the application, renaming the app.app/Contents directory, modifying the ASAR archive to inject malicious code, and renaming the directory back—an attacker can circumvent these protections.

This exploitation technique is documented in the HackTricks MacOS Process Abuse resource as a known method for injecting code into Electron applications on macOS.

Root Cause

The root cause stems from insufficient validation of the application bundle integrity at runtime and the Electron framework's susceptibility to ASAR archive tampering. When the modified Miro Desktop application is launched, it executes the injected malicious code with the same privileges as the legitimate application, including any TCC permissions previously granted by the user.

Additionally, the lack of code signing validation during the ASAR loading process allows tampered archives to be processed without triggering security alerts.

Attack Vector

The attack requires local access to the target macOS system and follows a multi-step process:

  1. File Copy: The attacker creates a copy of the Miro Desktop application bundle to a location where they have write permissions
  2. Directory Rename: The app.app/Contents directory is renamed to bypass TCC bundle protection monitoring
  3. ASAR Modification: The application's ASAR archive is extracted, malicious JavaScript code is injected, and the archive is repackaged
  4. Restore Structure: The directory is renamed back to app.app/Contents
  5. Execution: When the modified application launches, the injected code executes with full application privileges

The attacker can inject code that accesses sensitive data, captures user credentials, or establishes persistence on the compromised system. Technical details and proof-of-concept code are available in the GitHub Repository CVE-2024-23746.

Stop Remote Code Execution Before It Runs

Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.

Stop Exploit Attempts

Detection Methods for CVE-2024-23746

Indicators of Compromise

  • Unexpected modifications to Miro Desktop application bundle files or ASAR archives
  • Changes to the app.app/Contents directory structure or unusual renaming patterns
  • Presence of unauthorized JavaScript files within the Electron application resources
  • Modified file hashes for ASAR archives compared to legitimate Miro releases

Detection Strategies

  • Monitor file system events for operations targeting /Applications/Miro.app/ and related Electron bundle directories
  • Implement integrity monitoring to detect changes to application ASAR archives using hash comparisons
  • Watch for suspicious process activity involving asar extraction or packing utilities
  • Alert on applications running from non-standard locations with names similar to legitimate applications

Monitoring Recommendations

  • Enable macOS Unified Logging and monitor for TCC-related events involving bundle modifications
  • Deploy endpoint detection and response (EDR) solutions with behavioral analysis for Electron application tampering
  • Configure SentinelOne to detect anomalous file operations within macOS application bundles
  • Monitor for JavaScript execution within Electron applications that deviates from baseline behavior

How to Mitigate CVE-2024-23746

Immediate Actions Required

  • Update Miro Desktop to the latest available version beyond 0.8.18
  • Review application bundle integrity using code signing verification tools
  • Audit systems for signs of compromise using the indicators listed above
  • Restrict user permissions to modify application directories where feasible

Patch Information

Users should upgrade Miro Desktop to the latest version available. Verify the application signature after installation using macOS code signing utilities. Consult the Miro Company Overview page for official update channels and security guidance.

The Electron Blog CVE Statement provides additional context on Electron application security and recommended mitigations for this class of vulnerabilities.

Workarounds

  • Enable macOS System Integrity Protection (SIP) to prevent unauthorized modifications to system applications
  • Configure file system permissions to restrict write access to application bundle directories
  • Use application whitelisting solutions to prevent execution of tampered Electron applications
  • Consider deploying applications to protected system directories rather than user-writable locations
bash
# Verify application code signing integrity
codesign --verify --deep --strict /Applications/Miro.app

# Check for recent modifications to application bundle
find /Applications/Miro.app -type f -mtime -7 -ls

# Enable macOS firewall and restrict network access for untrusted applications
/usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne