Executive brief
Electron's AutoUpdater module on macOS fails to validate all components of application bundles during code signature checks. This allows attackers with control over an application's update server to inject malicious code into update packages that will still pass signature validation. The attack requires significant access to the target application's update infrastructure and would result in arbitrary code execution on affected systems.
Technical details
The vulnerability is a code signing validation bypass (CWE-20: Improper Input Validation) in Electron's AutoUpdater module on macOS. The AutoUpdater validates code signatures on update bundles but fails to check certain nested components within the bundle structure, allowing maliciously crafted packages to contain unsigned or invalid code that escapes detection. Attack preconditions require that the attacker has control over or can compromise the application's update server or update storage infrastructure. An attacker exploiting this can achieve arbitrary code execution with the privileges of the Electron application. Patches are available in Electron 15.5.0, 16.2.0, 17.2.0, and 18.0.0-beta.6 and later.
Affected products
- Electron Electron All versions before 15.5.0, 16.0.0-beta.1 to 16.1.x, 17.0.0-beta.1 to 17.1.x, 18.0.0-beta.1 to 18.0.0-beta.5
Timeline
- 2022-06-13: disclosed: Vulnerability initially reported to NVD
- 2022-06-16: disclosed: GitHub Security Advisory GHSA-77xc-hjv8-ww97 published
- 2022-06-16: patched: Patches released in Electron 15.5.0, 16.2.0, 17.2.0, and 18.0.0-beta.6