Executive brief
Electron is a popular framework used to build desktop applications like Slack, Discord, and VS Code. A security flaw allowed these applications to connect to nearby Bluetooth devices without the user's explicit permission. While the vulnerability only allows access to a random device rather than a specific target, it could lead to unauthorized data access or interaction with hardware in the user's physical environment.
Technical details
A vulnerability in Electron's implementation of the Web Bluetooth API allows renderer processes to obtain access to a Bluetooth device without explicit user permission. This occurs if the application developer has not implemented a custom 'select-bluetooth-device' event handler, causing the framework to potentially default to an insecure state. An attacker operating within a renderer process can trigger a device request; while they cannot target a specific device (the selection is random), they can interact with the resulting connection. The issue is rooted in missing authorization logic (CWE-862) and improper resource exposure (CWE-668). Patches were released in versions 13.6.6, 14.2.4, 15.3.5, 16.0.6, and 17.0.0-alpha.6.
Affected products
- Electron Electron < 13.6.6, 14.0.0-beta.1 to < 14.2.4, 15.0.0-beta.1 to < 15.3.5, 16.0.0-beta.1 to < 16.0.6, 17.0.0-alpha.1 to < 17.0.0-alpha.6
Timeline
- 2021-12-15: patched: Initial fix merged into main branch
- 2022-03-22: disclosed
- 2022-03-22: advisory