Executive brief
electron-updater is a library used by Electron-based desktop applications to automatically download and install software updates. An attacker who controls an update server (via compromise, man-in-the-middle attack, or cross-site scripting) can craft a malicious update manifest that bypasses Windows code signature verification, allowing execution of unsigned or maliciously-signed code. This permits full system compromise on affected machines when users accept the update.
Technical details
The vulnerability exists in windowsExecutableCodeSignatureVerifier.ts, which validates update signatures by executing PowerShell's Get-AuthenticodeSignature command via cmd.exe shell. Due to improper shell escaping, environment variable expansion occurs before signature verification, allowing an attacker to manipulate the command to validate a different file's signature than the downloaded update. The attack requires a compromised or intercepted update manifest but no user privileges or special network position beyond manifest control. Verification fails to compare the file path returned by Get-AuthenticodeSignature against the intended path. The vulnerability was fixed in version 6.3.0-alpha.6 by adding path comparison validation (CWE-154: Improper Neutralization of Variable Name Delimiters; CWE-295: Improper Certificate Validation).
Affected products
- electron-userland electron-updater <= 6.3.0-alpha.5
Timeline
- 2024-07-09: disclosed
- 2024-07-09: patched: Fixed in version 6.3.0-alpha.6