Is CVE-2018-15685 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2018-15685 being exploited in the wild.

How severe is CVE-2018-15685?

Low severity, with a CVSS score of 3, published 23 August 2018.

Which products and versions are affected?

electron (npm) SEMVER:introduced=1.7.0,fixed=1.7.16.

Is there a fix for CVE-2018-15685?

Yes. electron (npm): upgrade to 1.7.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2018-15685 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2018-15685?

Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2018-15685: Electron webPreferences remote code execution

CVE-2018-15685 · Severity: low · CVSS 3 · Published 2018-08-23

Electron is a framework used to build cross-platform desktop applications (including Slack, Discord, and VS Code). A vulnerability in how Electron handles security settings (webPreferences) for embedded web content allows an attacker to bypass sandbox protections and execute arbitrary code on a user's computer. Applications built with affected Electron versions are vulnerable if they use certain web content loading features.

Technologies: electron (npm). Vendors: npm.

Quick answers

Is CVE-2018-15685 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2018-15685 being exploited in the wild.
How severe is CVE-2018-15685?: Low severity, with a CVSS score of 3, published 23 August 2018.
Which products and versions are affected?: electron (npm) SEMVER:introduced=1.7.0,fixed=1.7.16.
Is there a fix for CVE-2018-15685?: Yes. electron (npm): upgrade to 1.7.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2018-15685 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2018-15685?: Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

electron (npm): upgrade to 1.7.16 or later
```
npm install electron@1.7.16
```

Technical details

The vulnerability exists in Electron's webPreferences configuration handling, specifically in how security settings are inherited when IFRAME elements are used in conjunction with "nativeWindowOpen: true" or "sandbox: true" options. An attacker can craft malicious HTML or JavaScript that exploits the improper inheritance of webPreferences sub-properties to escape the sandbox and execute arbitrary code with the privileges of the Electron application. The attack requires no user authentication and can be triggered over the network if the application loads untrusted web content. Patches are available in Electron 1.7.16, 1.8.8, 2.0.8, and 3.0.0-beta.7 or later.

Affected products

OpenJS Foundation Electron 1.7.0-1.7.15, 1.8.0-1.8.7, 2.0.0-2.0.7, 3.0.0-beta.1 to 3.0.0-beta.6

Identifiers

CVE-2018-15685
GHSA-hv9c-qwqg-qj3v

Timeline

2018-08-23: disclosed
2018-08: patched: Fixes available in Electron 1.7.16, 1.8.8, 2.0.8, and 3.0.0-beta.7

References

https://github.com/electron/electron/commit/519a02d8d4d28e8a467acb40fb26172a80c9454f

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.