Is CVE-2020-4077 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-4077 being exploited in the wild.

How severe is CVE-2020-4077?

Low severity, with a CVSS score of 3.1, published 7 July 2020.

Which products and versions are affected?

electron (npm) SEMVER:introduced=0,fixed=7.2.4.

Is there a fix for CVE-2020-4077?

Yes. electron (npm): upgrade to 7.2.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-4077 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2020-4077?

Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-4077: Electron context isolation bypass via contextBridge

CVE-2020-4077 · Severity: low · CVSS 3.1 · Published 2020-07-07

Electron is a framework used to build cross-platform desktop applications with web technologies. Apps that use both context isolation and the contextBridge feature are vulnerable to a bypass that allows untrusted renderer code to access privileged Electron APIs. An attacker with code execution in the renderer process can exploit this to perform actions normally restricted to the main process, potentially leading to unauthorized access to sensitive data or system resources.

Technologies: electron (npm). Vendors: npm.

Quick answers

Is CVE-2020-4077 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-4077 being exploited in the wild.
How severe is CVE-2020-4077?: Low severity, with a CVSS score of 3.1, published 7 July 2020.
Which products and versions are affected?: electron (npm) SEMVER:introduced=0,fixed=7.2.4.
Is there a fix for CVE-2020-4077?: Yes. electron (npm): upgrade to 7.2.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-4077 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2020-4077?: Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

electron (npm): upgrade to 7.2.4 or later
```
npm install electron@7.2.4
```

Technical details

This is a context isolation bypass vulnerability affecting Electron versions that support both contextIsolation and contextBridge. The vulnerability allows code running in the main world context of the renderer process to escape isolation boundaries and reach into the privileged Electron context, enabling execution of restricted operations. The flaw affects all versions before 7.2.4, versions 8.0.0 through 8.2.3, and beta versions of 9.0.0 up to 9.0.0-beta.20. The attack requires code execution in the renderer process but no user interaction or authentication. Fixes are available in versions 7.2.4, 8.2.4, and 9.0.0-beta.21 or later, and apps must update their Electron dependency to be protected.

Affected products

OpenJS Foundation Electron <7.2.4, 8.0.0-8.2.3, 9.0.0-beta.0 to 9.0.0-beta.20

Identifiers

CVE-2020-4077
GHSA-h9jc-284h-533g

Timeline

2020-07-07: disclosed
2020-07-07: patched: Patches released for versions 7.2.4, 8.2.4, and 9.0.0-beta.21

References

https://github.com/electron/electron/security/advisories/GHSA-h9jc-284h-533g

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.