giovannipajeu1/cve-2024-23738Proof-of-concept exploit for CVE-2024-23738 targeting Postman on macOS. Automates vulnerability detection and code injection via Electron settings to achieve remote shell access.
An issue in Postman through 10.22 on macOS allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings.
There is a tool designed to automate the process of searching for vulnerabilities in electron: https://github.com/r3ggi/electroniz3r
With this tool, we can check if the App is Vulnerable:
After validation, we can inject our code, and get a shell
Enjoy Your Shell :)
