Executive brief
Electron, a framework used to build desktop applications, contains a command injection vulnerability in its protocol handler. An attacker can craft a specially formatted link that, when opened in a browser by a user, executes arbitrary system commands on the victim's machine. This could allow unauthorized access, data theft, or system compromise.
Technical details
The vulnerability is a command injection flaw (CWE-78) in Electron's protocol handler argument blacklist validation. The blacklist check was case-sensitive, allowing attackers to bypass restrictions by using different case variations (e.g., "msiexec" vs "MSIEXEC"). When a user clicks a malicious Electron protocol link in their browser, unsanitized arguments are passed to the command line, enabling arbitrary command execution. The attack requires user interaction (clicking a link) but no authentication. The vulnerability affects Electron versions up to 1.8.2-beta.4 and was fixed in 1.8.2-beta.5 by implementing case-insensitive blacklist comparisons.
Affected products
- OpenJS Foundation Electron <=1.8.2-beta.4
Timeline
- 2018-03-26: disclosed
- 2018-03-26: patched: Fixed in Electron 1.8.2-beta.5
- 2018: other: Incomplete fix for CVE-2018-1000006