Is CVE-2020-15174 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-15174 being exploited in the wild.

How severe is CVE-2020-15174?

Low severity, with a CVSS score of 3.1, published 6 October 2020.

Which products and versions are affected?

ElectronJS Electron >= 8.0.0, = 9.0.0, = 10.0.0, < 10.0.1.

Is there a fix for CVE-2020-15174?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2020-15174 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2020-15174?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-15174: Electron navigation bypass via cross-site sub-frame navigation

Q: Is there a fix for CVE-2020-15174?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2020-15174 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2020-15174?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-15174 · Severity: low · CVSS 3.1 · Published 2020-10-06

Electron is a framework used to build desktop applications like Slack, Discord, and VS Code. A security flaw allowed embedded content (like an advertisement or a third-party widget) to force the entire application to navigate to a different, potentially malicious website, bypassing the app's built-in security filters. This could be used to redirect users to phishing sites or unauthorized external content.

Quick answers

Is CVE-2020-15174 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-15174 being exploited in the wild.
How severe is CVE-2020-15174?: Low severity, with a CVSS score of 3.1, published 6 October 2020.
Which products and versions are affected?: ElectronJS Electron >= 8.0.0, < 8.5.1; >= 9.0.0, < 9.3.0; >= 10.0.0, < 10.0.1.
Is there a fix for CVE-2020-15174?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2020-15174 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2020-15174?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in Electron's navigation handling allowed sub-frames to bypass the 'will-navigate' event when performing a cross-site top-frame navigation. The 'will-navigate' event is the primary mechanism developers use to intercept and cancel unexpected navigation requests. By triggering a navigation from a sub-frame to the top-level frame across different origins, an attacker could circumvent these programmatic security checks. The fix involved refactoring the 'will-navigate' logic to use a navigation throttle within the browser process. Developers are advised to upgrade to patched versions or use the 'sandbox' attribute on all iframes as a workaround.

Affected products

ElectronJS Electron >= 8.0.0, < 8.5.1; >= 9.0.0, < 9.3.0; >= 10.0.0, < 10.0.1

Identifiers

CVE-2020-15174
GHSA-2q4g-w47c-4674

Timeline

2020-10-05: advisory: GitHub Advisory published
2020-10-06: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.