Executive brief
Electron is a popular framework for building cross-platform desktop applications. A vulnerability allows attackers with limited privileges to bypass security policies that are meant to prevent dynamic code execution (eval) when the renderer process has both sandbox and context isolation disabled. This can expand the attack surface and enable code injection attacks.
Technical details
The vulnerability is a policy enforcement bypass (CWE-670) affecting Electron versions 22.0.0-beta.1 through 22.0.0 and 23.0.0-alpha.1 through 23.0.0-alpha.1. When a renderer process is configured with both sandbox: false and contextIsolation: false in webPreferences, the Content-Security-Policy directive that disables eval is not properly enforced, allowing calls to eval() and new Function() to execute. An attacker with low privileges and network access can exploit this (AC:H indicates additional complexity required) to achieve code execution with high impact on confidentiality, integrity, and availability. The issue was patched in Electron 22.0.1 and 23.0.0-alpha.2. Workarounds include enabling at least one of sandbox or contextIsolation.
Affected products
- Electron Electron >=22.0.0-beta.1 <22.0.1, >=23.0.0-alpha.1 <23.0.0-alpha.2
Timeline
- 2023-09-06: disclosed
- 2023-09-06: patched