CVE-2022-29247: Electron compromised renderer IPC access bypass

CVE-2022-29247 · Severity: low · CVSS 3.1 · Published 2022-06-16

Electron is a framework used to build desktop applications. A compromised renderer process in an Electron application could gain unauthorized access to inter-process communication (IPC) channels even when the nodeIntegrationInSubFrames setting was disabled. This could allow an attacker to send privileged IPC messages and potentially compromise sensitive application data or functionality.

Technologies: electron (npm). Vendors: npm.

Quick answers

Is CVE-2022-29247 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2022-29247 being exploited in the wild.
How severe is CVE-2022-29247?
Low severity, with a CVSS score of 3.1, published 16 June 2022.
Which products and versions are affected?
electron (npm) SEMVER:introduced=0,fixed=15.5.5.
Is there a fix for CVE-2022-29247?
Yes. electron (npm): upgrade to 15.5.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-29247 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2022-29247?
Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • electron (npm): upgrade to 15.5.5 or later
    npm install electron@15.5.5

Technical details

This vulnerability is a privilege escalation in Electron's renderer process isolation. A compromised child renderer process with JavaScript execution capability could create or obtain access to a new renderer process with nodeIntegrationInSubFrames enabled, gaining effective access to ipcRenderer without the protection the parent intended. The attack requires an initial compromised renderer (e.g., via XSS or similar JS execution vulnerability) and depends on the target application exposing IPC message handlers that lack proper senderFrame validation. The vulnerability affects Electron versions before 15.5.5, 16.0.0-16.2.5, 17.0.0-17.1.x, and 18.0.0-beta.1 through beta.5. Patches are available in Electron 15.5.5, 16.2.6, 17.2.0, and 18.0.0-beta.6 or later.

Affected products

  • OpenJS Foundation Electron < 15.5.5, >= 16.0.0-beta.1 < 16.2.6, >= 17.0.0-beta.1 < 17.2.0, >= 18.0.0-beta.1 < 18.0.0-beta.6

Identifiers

  • CVE-2022-29247
  • GHSA-mq8j-3h7h-p8g7

Timeline

  • 2022-06-13: disclosed
  • 2022-06-13: patched: Patches released in versions 15.5.5, 16.2.6, 17.2.0, 18.0.0-beta.6

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.