CVE-2024-23745

In Notion Web Clipper 1.0.3(7), a .nib file is susceptible to the Dirty NIB attack. NIB files can be manipulated to execute arbitrary commands. Additionally, even if a NIB file is modified within an application, Gatekeeper may still permit the execution of the application, enabling the execution of arbitrary commands within the application's context.

Impact

Attackers could exploit this vulnerability to execute unauthorized commands within the Notion application, potentially compromising sensitive user data or performing malicious actions.

PoC

• First, you need create de malicious NIB

More details in: https://blog.xpnsec.com/dirtynib/

- Notion Application


- Copy malicious nib to app - Open the malicous application