CVE-2023-29198: Electron context isolation bypass via nested unserializable return value

CVE-2023-29198 · Severity: low · CVSS 3.1 · Published 2023-09-06

Electron is a framework used to build cross-platform desktop applications using web technologies. When an application uses context isolation and context bridge features, code running in the main renderer context can bypass security boundaries and access privileged functionality through malformed object returns or exception handling in exposed APIs. This could allow a local attacker to escalate privileges or access sensitive data within the application.

Technologies: electron (npm). Vendors: npm.

Quick answers

Is CVE-2023-29198 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2023-29198 being exploited in the wild.
How severe is CVE-2023-29198?
Low severity, with a CVSS score of 3.1, published 6 September 2023.
Which products and versions are affected?
electron (npm) SEMVER:introduced=0,fixed=22.3.6.
Is there a fix for CVE-2023-29198?
Yes. electron (npm): upgrade to 22.3.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-29198 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2023-29198?
Check whether you run electron (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • electron (npm): upgrade to 22.3.6 or later
    npm install electron@22.3.6

Technical details

This is a context isolation bypass vulnerability in Electron's contextBridge mechanism. The vulnerability occurs when APIs exposed via contextBridge return objects or arrays containing unserializable JavaScript objects (such as canvas rendering contexts), or when return values throw user-generated exceptions during serialization. Normally these conditions throw an "object could not be cloned" error; however, the improper error handling allows code in the main renderer context to reach into the isolated Electron context and perform privileged actions. The attack requires that an application exposes vulnerable APIs through contextBridge and does not properly validate all return values. Patches are available in versions 22.3.6, 23.2.3, 24.0.1, and 25.0.0-alpha.2 and later.

Affected products

  • OpenJS Foundation Electron < 22.3.6, >= 23.0.0-alpha.1 < 23.2.3, >= 24.0.0-alpha.1 < 24.0.1, >= 25.0.0-alpha.1 < 25.0.0-alpha.2

Identifiers

  • CVE-2023-29198
  • GHSA-p7v2-p9m8-qqg7

Timeline

  • 2023-09-06: disclosed
  • 2023-09-06: patched: Patches released for versions 22.3.6, 23.2.3, 24.0.1, and 25.0.0-alpha.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.