Vulnerabilites related to electron-userland - electron-builder
CVE-2024-39698 (GCVE-0-2024-39698)
Vulnerability from cvelistv5
Published
2024-07-09 17:50
Modified
2024-08-02 04:26
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-154 - Improper Neutralization of Variable Name Delimiters
Summary
electron-updater allows for automatic updates for Electron apps. The file `packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts` implements the signature validation routine for Electron applications on Windows. Because of the surrounding shell, a first pass by `cmd.exe` expands any environment variable found in command-line above. This creates a situation where `verifySignature()` can be tricked into validating the certificate of a different file than the one that was just downloaded. If the step is successful, the malicious update will be executed even if its signature is invalid. This attack assumes a compromised update manifest (server compromise, Man-in-the-Middle attack if fetched over HTTP, Cross-Site Scripting to point the application to a malicious updater server, etc.). The patch is available starting from 6.3.0-alpha.6.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| electron-userland | electron-builder |
Version: < 6.3.0-alpha.6 |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:electron:electron:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "electron",
"vendor": "electron",
"versions": [
{
"lessThan": "6.3.0-alpha.6",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-39698",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-10T14:40:10.938790Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-10T14:41:06.824Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T04:26:15.985Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/electron-userland/electron-builder/security/advisories/GHSA-9jxc-qjr9-vjxq",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/electron-userland/electron-builder/security/advisories/GHSA-9jxc-qjr9-vjxq"
},
{
"name": "https://github.com/electron-userland/electron-builder/pull/8295",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/electron-userland/electron-builder/pull/8295"
},
{
"name": "https://github.com/electron-userland/electron-builder/commit/ac2e6a25aa491c1ef5167a552c19fc2085cd427f",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/electron-userland/electron-builder/commit/ac2e6a25aa491c1ef5167a552c19fc2085cd427f"
},
{
"name": "https://github.com/electron-userland/electron-builder/blob/140e2f0eb0df79c2a46e35024e96d0563355fc89/packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts#L35-L41",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/electron-userland/electron-builder/blob/140e2f0eb0df79c2a46e35024e96d0563355fc89/packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts#L35-L41"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "electron-builder",
"vendor": "electron-userland",
"versions": [
{
"status": "affected",
"version": "\u003c 6.3.0-alpha.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "electron-updater allows for automatic updates for Electron apps. The file `packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts` implements the signature validation routine for Electron applications on Windows. Because of the surrounding shell, a first pass by `cmd.exe` expands any environment variable found in command-line above. This creates a situation where `verifySignature()` can be tricked into validating the certificate of a different file than the one that was just downloaded. If the step is successful, the malicious update will be executed even if its signature is invalid. This attack assumes a compromised update manifest (server compromise, Man-in-the-Middle attack if fetched over HTTP, Cross-Site Scripting to point the application to a malicious updater server, etc.). The patch is available starting from 6.3.0-alpha.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-154",
"description": "CWE-154: Improper Neutralization of Variable Name Delimiters",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-09T17:50:28.169Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron-userland/electron-builder/security/advisories/GHSA-9jxc-qjr9-vjxq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron-userland/electron-builder/security/advisories/GHSA-9jxc-qjr9-vjxq"
},
{
"name": "https://github.com/electron-userland/electron-builder/pull/8295",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron-userland/electron-builder/pull/8295"
},
{
"name": "https://github.com/electron-userland/electron-builder/commit/ac2e6a25aa491c1ef5167a552c19fc2085cd427f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron-userland/electron-builder/commit/ac2e6a25aa491c1ef5167a552c19fc2085cd427f"
},
{
"name": "https://github.com/electron-userland/electron-builder/blob/140e2f0eb0df79c2a46e35024e96d0563355fc89/packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts#L35-L41",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron-userland/electron-builder/blob/140e2f0eb0df79c2a46e35024e96d0563355fc89/packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts#L35-L41"
}
],
"source": {
"advisory": "GHSA-9jxc-qjr9-vjxq",
"discovery": "UNKNOWN"
},
"title": "Code Signing Bypass on Windows in electron-updater \u003c 6.3.0-alpha.6"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-39698",
"datePublished": "2024-07-09T17:50:28.169Z",
"dateReserved": "2024-06-27T18:44:13.037Z",
"dateUpdated": "2024-08-02T04:26:15.985Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-27303 (GCVE-0-2024-27303)
Vulnerability from cvelistv5
Published
2024-03-06 18:35
Modified
2024-08-13 17:12
Severity ?
VLAI Severity ?
EPSS score ?
Summary
electron-builder is a solution to package and build a ready for distribution Electron, Proton Native app for macOS, Windows and Linux. A vulnerability that only affects eletron-builder prior to 24.13.2 in Windows, the NSIS installer makes a system call to open cmd.exe via NSExec in the `.nsh` installer script. NSExec by default searches the current directory of where the installer is located before searching `PATH`. This means that if an attacker can place a malicious executable file named cmd.exe in the same folder as the installer, the installer will run the malicious file. Version 24.13.2 fixes this issue. No known workaround exists. The code executes at the installer-level before the app is present on the system, so there's no way to check if it exists in a current installer.
References
| ► | URL | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| electron-userland | electron-builder |
Version: < 24.13.2 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:27:59.901Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/electron-userland/electron-builder/security/advisories/GHSA-r4pf-3v7r-hh55",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/electron-userland/electron-builder/security/advisories/GHSA-r4pf-3v7r-hh55"
},
{
"name": "https://github.com/electron-userland/electron-builder/pull/8059",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/electron-userland/electron-builder/pull/8059"
},
{
"name": "https://github.com/electron-userland/electron-builder/commit/8f4acff3c2d45c1cb07779bb3fe79644408ee387",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/electron-userland/electron-builder/commit/8f4acff3c2d45c1cb07779bb3fe79644408ee387"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:electron:electron-builder:*:*:*:*:*:node.js:*:*"
],
"defaultStatus": "unknown",
"product": "electron-builder",
"vendor": "electron",
"versions": [
{
"lessThan": "24.13.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-27303",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-03-07T20:09:00.747801Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-13T17:12:24.776Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "electron-builder",
"vendor": "electron-userland",
"versions": [
{
"status": "affected",
"version": "\u003c 24.13.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "electron-builder is a solution to package and build a ready for distribution Electron, Proton Native app for macOS, Windows and Linux. A vulnerability that only affects eletron-builder prior to 24.13.2 in Windows, the NSIS installer makes a system call to open cmd.exe via NSExec in the `.nsh` installer script. NSExec by default searches the current directory of where the installer is located before searching `PATH`. This means that if an attacker can place a malicious executable file named cmd.exe in the same folder as the installer, the installer will run the malicious file. Version 24.13.2 fixes this issue. No known workaround exists. The code executes at the installer-level before the app is present on the system, so there\u0027s no way to check if it exists in a current installer."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-426",
"description": "CWE-426: Untrusted Search Path",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-427",
"description": "CWE-427: Uncontrolled Search Path Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-06T18:35:37.973Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/electron-userland/electron-builder/security/advisories/GHSA-r4pf-3v7r-hh55",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/electron-userland/electron-builder/security/advisories/GHSA-r4pf-3v7r-hh55"
},
{
"name": "https://github.com/electron-userland/electron-builder/pull/8059",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron-userland/electron-builder/pull/8059"
},
{
"name": "https://github.com/electron-userland/electron-builder/commit/8f4acff3c2d45c1cb07779bb3fe79644408ee387",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/electron-userland/electron-builder/commit/8f4acff3c2d45c1cb07779bb3fe79644408ee387"
}
],
"source": {
"advisory": "GHSA-r4pf-3v7r-hh55",
"discovery": "UNKNOWN"
},
"title": "electron-builder\u0027s NSIS installer - execute arbitrary code on the target machine (Windows only)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-27303",
"datePublished": "2024-03-06T18:35:37.973Z",
"dateReserved": "2024-02-22T18:08:38.875Z",
"dateUpdated": "2024-08-13T17:12:24.776Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}