CVE-2024-23745
Description
In Notion Web Clipper 1.0.3(7), a .nib file is susceptible to the Dirty NIB attack. NIB files can be manipulated to execute arbitrary commands. Additionally, even if a NIB file is modified within an application, Gatekeeper may still permit the execution of the application, enabling the execution of arbitrary commands within the application's context. NOTE: the vendor's perspective is that this is simply an instance of CVE-2022-48505, cannot properly be categorized as a product-level vulnerability, and cannot have a product-level fix because it is about incorrect caching of file signatures on macOS.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Notion/Web Clipperdescription
- Range: = 1.0.3(7)
Patches
Vulnerability mechanics
Root cause
"A .nib file within the application bundle can be modified to embed arbitrary commands, and macOS Gatekeeper may not re-validate the application's signature after the NIB file is altered, allowing execution of the tampered code."
Attack vector
An attacker who can modify a .nib file bundled within the Notion Web Clipper application can embed arbitrary commands in the NIB file. Because macOS Gatekeeper may incorrectly cache the application's code signature and fail to re-validate it after the NIB file is altered, the modified application can still be launched. When the application loads the tampered NIB, the embedded commands execute within the application's context [ref_id=1]. The attack requires the attacker to have write access to the application bundle on the victim's machine.
Affected code
The advisory does not identify specific functions, files, or code paths. The vulnerability concerns the Notion Web Clipper 1.0.3(7) macOS application's handling of .nib files, which are Interface Builder resource files loaded by the application at runtime.
What the fix does
No patch is provided in the bundle. The vendor's position, as noted in the CVE description, is that this is not a product-level vulnerability but rather an instance of CVE-2022-48505, relating to incorrect caching of file signatures by macOS Gatekeeper. The vendor states that a product-level fix cannot be made because the root cause lies in the operating system's signature caching behavior, not in the Notion Web Clipper application itself [ref_id=1].
Preconditions
- authAttacker must have write access to the Notion Web Clipper application bundle on the victim's macOS system
- inputThe victim must launch the modified Notion Web Clipper application
Generated on May 26, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
2News mentions
0No linked articles in our index yet.