Executive brief
Electron is a popular framework used to build cross-platform desktop applications. A vulnerability in its module search mechanism allowed local attackers to escalate privileges by placing a malicious Node.js module in a parent directory where an application would load it instead of its intended module. This could enable an attacker with local system access to gain the same privileges as the application user.
Technical details
The vulnerability is an untrusted search path issue (CWE-426) in Electron before 0.33.5. Node.js module resolution automatically searches parent directories for modules, but Electron did not restrict this behavior, allowing local attackers to place Trojan horse Node.js modules in parent directories of a require path. When an application called require() on a module, Node would find and load the attacker's malicious version instead. The attack requires local access to the system and knowledge of which modules the target application imports. The fix (merged in PR #2976) restricts module search paths to remain within the application's resource directory, preventing access to system-wide Node modules directories.
Affected products
- GitHub Electron before 0.33.5
Timeline
- 2017-10-24: disclosed
- 2015-10-03: patched: Fix merged in PR #2976; patched in version 0.33.5