Executive brief
Electron Packager, a tool used to bundle Electron applications into executable files, contains a flaw that can leak sensitive build-server memory into the final application distributed to users. This leaked memory may contain environment variables, secret keys, or other private data from the developer's environment. An attacker who downloads the resulting application could extract this information, potentially leading to the compromise of developer credentials or infrastructure.
Technical details
A vulnerability in @electron/packager version 18.3.0 causes approximately 1-10kb of Node.js heap memory to be leaked into the final executable during the build process. The root cause is an improper handling of the integrity buffer in the 'resedit' component, specifically where the '.buffer' property of a Buffer object was being passed instead of the Buffer itself, leading to the inclusion of adjacent memory segments. This leaked memory can contain sensitive strings such as environment variables or secrets present in the build environment's heap. The issue is resolved in version 18.3.1 by correctly passing the Buffer object and ensuring proper encoding.
Affected products
- Electron @electron/packager 18.3.0
Timeline
- 2024-03-28: advisory: GitHub advisory published by maintainers
- 2024-03-29: disclosed: CVE-2024-29900 published
- 2024-03-29: patched: Version 18.3.1 released