Is CVE-2017-16151 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2017-16151 being exploited in the wild.

How severe is CVE-2017-16151?

Low severity, with a CVSS score of 3, published 24 July 2018.

Which products and versions are affected?

electron (npm) SEMVER:introduced=0,fixed=1.6.14.

Is there a fix for CVE-2017-16151?

Yes. electron (npm): upgrade to 1.6.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2017-16151 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2017-16151?

Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2017-16151: Electron Chromium remote code execution

CVE-2017-16151 · Severity: low · CVSS 3 · Published 2018-07-24

Electron is a framework for building cross-platform desktop applications using web technologies. A critical remote code execution vulnerability in the underlying Chromium engine affects all Electron applications that load remote content, bypassing sandbox protections. An attacker can exploit this by crafting malicious content that a user's application accesses, gaining complete control over the user's system including stealing sensitive data, modifying files, or installing malware.

Technologies: electron (npm). Vendors: npm.

Quick answers

Is CVE-2017-16151 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2017-16151 being exploited in the wild.
How severe is CVE-2017-16151?: Low severity, with a CVSS score of 3, published 24 July 2018.
Which products and versions are affected?: electron (npm) SEMVER:introduced=0,fixed=1.6.14.
Is there a fix for CVE-2017-16151?: Yes. electron (npm): upgrade to 1.6.14 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2017-16151 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2017-16151?: Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

electron (npm): upgrade to 1.6.14 or later
```
npm install electron@1.6.14
```

Technical details

This vulnerability is a code injection flaw (CWE-94) in Chromium that affects Electron applications. The root cause involves improper handling of remote content processing, allowing an attacker to inject and execute arbitrary code. The vulnerability can be exploited via a network vector with no privileges or user interaction required; even applications with the sandbox option enabled are vulnerable if they access remote content. An attacker can achieve remote code execution with full system access, including confidentiality, integrity, and availability compromise. Patches were released in Electron versions 1.6.14 and 1.7.8 or later to address this issue.

Affected products

GitHub Electron < 1.6.14, >= 1.7.0 and < 1.7.8

Identifiers

CVE-2017-16151
GHSA-4w88-rjj3-x7wp

Timeline

2017-09-27: disclosed: Vulnerability disclosed and fix announced
2018-07-24: advisory: GitHub Security Advisory GHSA-4w88-rjj3-x7wp published
2017-09-27: patched: Electron 1.6.14 and 1.7.8 released with fixes

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.