Executive brief
Electron is a framework used to build cross-platform desktop applications. A vulnerability allows an attacker to read arbitrary files from the local system by exploiting unsafe window options in child windows opened via window.open(). This could expose sensitive configuration files, source code, credentials, or other confidential data stored on the affected system.
Technical details
The vulnerability is a file disclosure flaw (CWE-552) in Electron's Inter-Process Communication (IPC) handling for window-open events. An attacker can craft a new child window with unsafe options that bypass access controls, allowing arbitrary local file read access. The attack requires local code execution context but does not require authentication. The vulnerability affects versions prior to 7.2.4, 8.0.0–8.2.3, and 9.0.0-beta versions up to beta.20. Developers can mitigate by calling event.preventDefault() on unexpected new-window events. Patches are available in versions 7.2.4, 8.2.4, and 9.0.0-beta.21.
Timeline
- 2020-07-06: disclosed
- 2020-07-06: patched: Patches released in versions 7.2.4, 8.2.4, and 9.0.0-beta.21