CVE-2024-23743: 
NixOS vulnerability analysis and mitigation

Notion through version 3.1.0 on macOS contains a disputed vulnerability (CVE-2024-23743) related to the RunAsNode and enableNodeClilnspectArguments components. The vulnerability allows potential code execution in the Electron-based application by launching it with nonstandard flags that transform it into a Node.js execution environment (MITRE CVE, NVD).

The vulnerability involves the exploitation of two Electron fuses - runAsNode and enableNodeCliInspectArguments. According to Electron's official statement, the attacker must have prior access to the system, either physical access or remote code execution capabilities, to exploit this vulnerability. When exploited, it allows the attacker to use the impacted application as a generic Node.js process with inherited TCC (Transparency, Consent, and Control) permissions (Electron Blog).

If successfully exploited, the vulnerability allows an attacker to execute the application as Node.js and run arbitrary code which inherits the application's permissions. For example, if the application has been granted access to the address book, the attacker can execute code with those same permissions. This is characterized as a 'living off the land' attack (Electron Blog).

The recommended mitigation is to disable the runAsNode fuse within the Electron app. However, disabling this fuse will affect process.fork functionality in the main process. As an alternative, Electron recommends using Utility Processes for scenarios requiring standalone Node.js processes. The Electron team also provides a Security Checklist for implementing additional security measures (Electron Blog).

The Electron team has disputed the severity of the CVEs, stating they were not filed in good faith. They argue that the 'Critical' severity rating is inappropriate as the vulnerability requires pre-existing system access. Additionally, they note that affected companies with bug bounty programs were not properly notified before the CVE publication (Electron Blog).