Executive brief
electron-builder is a build tool used to package Electron applications into installers for Windows. The NSIS installer component searches the current directory for executables before checking the system PATH, allowing an attacker who can place a malicious cmd.exe file in the installer's directory to execute arbitrary code during installation. An attacker could gain full control over a Windows system during the application installation process.
Technical details
The vulnerability is a DLL/executable search path hijacking issue (CWE-426, CWE-427) in electron-builder's NSIS installer script. The NSIS NSExec function, called by the .nsh installer script, executes cmd.exe but searches the current directory (where the installer binary is located) before searching the system PATH. An attacker with the ability to place a file in the same directory as the installer can substitute a malicious cmd.exe that will be executed with the privileges of the installer process. The attack requires local access and user interaction (running the installer), but results in arbitrary code execution with high impact to confidentiality, integrity, and availability. The vulnerability has been patched in app-builder-lib version 24.13.2 and later.
Affected products
- electron-userland electron-builder < 24.13.2
Timeline
- 2024-03-04: disclosed: Security advisory GHSA-r4pf-3v7r-hh55 published
- 2024-03-04: patched: Fixed in app-builder-lib 24.13.2 via PR #8059