Code Execution Vulnerability in Kong Insomnia for macOS
CVE-2023-40299

7.8HIGH

Key Information:

Vendor

Konghq

Status
Insomnia
Vendor
CVE Published:
4 October 2023

What is CVE-2023-40299?

Kong Insomnia version 2023.4.0 on macOS is susceptible to a security flaw that allows attackers to execute arbitrary code by manipulating the DYLD_INSERT_LIBRARIES environment variable. This vulnerability could enable unauthorized access to restricted files or facilitate requests for TCC (Transparency, Consent, and Control) permissions, potentially compromising sensitive user data and system integrity.

References

https://insomnia.rest/changelog
https://github.com/Kong/insomnia/releases
https://www.angelystor.com/posts/cve-2023-40299/

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.