Executive brief
Electron, a framework used to build desktop applications, contains a vulnerability in its PDF viewer that allows attackers to spoof URLs when PDFs are opened. An attacker can craft a malicious PDF that appears to load from a legitimate source but actually loads arbitrary content controlled by the attacker, enabling phishing attacks or deceptive content delivery.
Technical details
The vulnerability is a URL spoofing/authentication bypass issue (CWE-290, CWE-345) in Electron's PDFium-based PDF viewer, affecting versions 1.7.0 through 1.7.5. The root cause is improper query string parsing in the PDF viewer component, which allows attackers to manipulate the displayed URL through crafted PDF parameters. The attack requires user interaction (opening a malicious PDF) but no authentication or special network conditions. An attacker can trick users into believing they are accessing one PDF when loading another, facilitating social engineering or malware distribution. The vulnerability was patched in Electron 1.7.6.
Affected products
- Electron Electron 1.7.0 to 1.7.5
Timeline
- 2022-05-13: disclosed
- 1.7.6: patched