Executive brief
Electron is a framework used to build desktop applications using web technologies. This vulnerability allows an attacker to re-enable Node.js integration in Electron applications that explicitly disabled it for security purposes, enabling arbitrary code execution on the user's system. The attack requires the application to allow remote code execution and not enforce additional security controls.
Technical details
This is an input validation (CWE-20) vulnerability in Electron's webview handling. Applications running vulnerable versions of Electron (1.7 through 1.8.x and 2.0.0-beta versions before beta.5) that disabled Node.js integration could have it re-enabled via improper handling of new-window events and webview tag preferences. An attacker can create a new window or webview with Node.js integration explicitly set in the options, bypassing the application's intended security policy. No authentication or special privileges are required; exploitation depends on the application accepting remote untrusted content. Fixed in Electron 1.7.13, 1.8.4, and 2.0.0-beta.5 or later.
Affected products
- OpenJS Foundation Electron 1.7.0 through 1.7.12, 1.8.0 through 1.8.3, 2.0.0-beta.1 through 2.0.0-beta.4
Timeline
- 2018-03-26: disclosed
- 2018-03-26: patched: Fixed in versions 1.7.13, 1.8.4, and 2.0.0-beta.5