Executive brief
electron-packager is a tool used to package Electron applications for distribution. The CLI interface disables SSL certificate verification by default when downloading Electron binaries, allowing an attacker positioned on the network to intercept and replace legitimate downloads with malicious versions during the application packaging process.
Technical details
The vulnerability is a failure to validate SSL certificates (CWE-295) in the electron-packager CLI tool when downloading Electron binaries for different platforms and architectures. The strict-ssl option defaults to false in the CLI, whereas the Node.js API correctly defaults to true. An attacker with a privileged network position (e.g., on a shared network, ISP level, or via ARP spoofing/DNS hijacking) can perform a man-in-the-middle attack to intercept HTTP/HTTPS downloads and serve tampered Electron binaries. This affects users who call electron-packager via the command-line interface. The vulnerability was fixed in version 7.0.0 and later; users should upgrade and delete the cached electron-download folder at ~/.electron.
Affected products
- electron-userland electron-packager 5.2.1 to 6.x
Timeline
- 2019-02-18: disclosed
- 7.0.0: patched