Electron vulnerable to remote command execution
Published 17 May 2022 · Updated 8 Nov 2023
Affected package
- Affected
- <1.6.8
- Fixed in
- 1.6.8
npm install electron@1.6.8Details
Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earlier. Bypassing the Same Origin Policy (SOP) is a precondition; however, recent Electron versions do not have strict SOP enforcement. Combining an SOP bypass with a privileged URL internally used by Electron, it was possible to execute native Node.js primitives in order to run OS commands on the user's host. Specifically, a chrome-devtools://devtools/bundled/inspector.html window could be used to eval a Node.js child_process.execFile API call.
Is GHSA-7fv9-m79r-j9x8 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected electron, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2017-12581
- Linkgithub.com/electron/electron/commit/05b6d91bf4c1e0ee65eeef70cd5d1bd1df125644
- Linkblog.doyensec.com/2017/08/03/electron-framework-security.html
- Linkdoyensec.com/resources/us-17-Carettoni-Electronegativity-A-Study-Of-Electron-Security.pdf
- Packagegithub.com/electron/electron
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.