Vulnerabilities

 262 via 326 paths

Dependencies

 423

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 14
  • 165
  • 74
  • 9
Status
  • 262
  • 0
  • 0

critical severity

Improper Input Validation

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@13.6.8.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Improper Input Validation via Mojo. If the endpoint's task runner does not match the current task runner (or an equivalent main-thread task runner for the ChannelProxy) when executing a message dispatch task for that endpoint, it dispatches it on the wrong sequence.

Remediation

Upgrade electron to version 13.6.8, 14.2.4, 15.3.5 or higher.

References

Improper Input Validation vulnerability report

critical severity

Type Confusion

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@15.5.3.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Type Confusion in V8 Turbofan, exploiting this vulnerability is possible via a crafted HTML page.

Remediation

Upgrade electron to version 15.5.3, 16.2.4, 17.4.2 or higher.

References

Type Confusion vulnerability report

critical severity

Type Confusion

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@27.3.9.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Type Confusion due to a flaw in the WebAssembly component. An attacker can execute arbitrary code on the victim's machine by convincing them to visit a maliciously crafted HTML page.

Remediation

Upgrade electron to version 27.3.9, 28.2.10, 29.2.0 or higher.

References

Type Confusion vulnerability report

critical severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@27.3.3.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free via the Mojo interface. An attacker can potentially exploit heap corruption by delivering a crafted HTML page.

Remediation

Upgrade electron to version 27.3.3 or higher.

References

Use After Free vulnerability report

critical severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@27.3.9.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free due to improper handling of objects in memory in the ANGLE graphics engine. An attacker can cause heap corruption and potentially execute arbitrary code by convincing a user to visit a specially crafted HTML page.

Remediation

Upgrade electron to version 27.3.9, 28.2.10, 29.2.0 or higher.

References

Use After Free vulnerability report

critical severity

Access of Resource Using Incompatible Type ('Type Confusion')

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@37.2.5.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type ('Type Confusion') via the lack of limitation on max inlining ids in MaglevGraphBuilder. An attacker can achieve heap corruption and potentially execute arbitrary code by enticing a user to visit a specially crafted HTML page.

Remediation

Upgrade electron to version 37.2.5 or higher.

References

Access of Resource Using Incompatible Type ('Type Confusion') vulnerability report

critical severity

Out-of-bounds Read

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@29.4.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Out-of-bounds Read via a crafted HTML page. An attacker can potentially perform a sandbox escape by manipulating the memory outside its intended buffer limits.

Remediation

Upgrade electron to version 29.4.6, 30.4.0 or higher.

References

Out-of-bounds Read vulnerability report

critical severity

Type Confusion

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@31.7.1.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Type Confusion via crafted HTML content. This can be exploited to escape the v8 sandbox and execute arbitrary code on the operating system.

Remediation

Upgrade electron to version 31.7.1, 32.2.1 or higher.

References

Type Confusion vulnerability report

critical severity

Predictable Value Range from Previous Values

  • Vulnerable module: form-data
  • Introduced through: electron-rebuild@2.3.5

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › node-gyp@7.1.2 › request@2.88.2 › form-data@2.3.3

Overview

Affected versions of this package are vulnerable to Predictable Value Range from Previous Values via the boundary value, which uses Math.random(). An attacker can manipulate HTTP request boundaries by exploiting predictable values, potentially leading to HTTP parameter pollution.

Remediation

Upgrade form-data to version 2.5.4, 3.0.4, 4.0.4 or higher.

References

Predictable Value Range from Previous Values vulnerability report

critical severity

Prototype Pollution

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@39.8.9.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Prototype Pollution in the contextBridge boundary. An attacker can influence the prototype of objects copied across the boundary by providing specially crafted objects from untrusted content, potentially enabling unauthorized access or modification of properties in preload code that does not perform own-property checks.

Note: This is only exploitable if preload code accepts object arguments from untrusted content and reads properties from them without validating ownership.

Workaround

This vulnerability can be mitigated by validating objects received from untrusted content with own-property checks (such as using Object.hasOwn), or by copying them onto a null-prototype object before use.

Details

Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as __proto__, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.

There are two main ways in which the pollution of prototypes occurs:

  • Unsafe Object recursive merge

  • Property definition by path

Unsafe Object recursive merge

The logic of a vulnerable recursive merge function follows the following high-level model:

merge (target, source)

  foreach property of source

    if property exists and is an object on both the target and the source

      merge(target[property], source[property])

    else

      target[property] = source[property]

When the source object contains a property named __proto__ defined with Object.defineProperty() , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of Object and the source of Object as defined by the attacker. Properties are then copied on the Object prototype.

Clone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: merge({},source).

lodash and Hoek are examples of libraries susceptible to recursive merge attacks.

Property definition by path

There are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: theFunction(object, path, value)

If the attacker can control the value of “path”, they can set this value to __proto__.myValue. myValue is then assigned to the prototype of the class of the object.

Types of attacks

There are a few methods by which Prototype Pollution can be manipulated:

Type Origin Short description
Denial of service (DoS) Client This is the most likely attack.
DoS occurs when Object holds generic functions that are implicitly called for various operations (for example, toString and valueOf).
The attacker pollutes Object.prototype.someattr and alters its state to an unexpected value such as Int or Object. In this case, the code fails and is likely to cause a denial of service.
For example: if an attacker pollutes Object.prototype.toString by defining it as an integer, if the codebase at any point was reliant on someobject.toString() it would fail.
Remote Code Execution Client Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
For example: eval(someobject.someattr). In this case, if the attacker pollutes Object.prototype.someattr they are likely to be able to leverage this in order to execute code.
Property Injection Client The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
For example: if a codebase checks privileges for someuser.isAdmin, then when the attacker pollutes Object.prototype.isAdmin and sets it to equal true, they can then achieve admin privileges.

Affected environments

The following environments are susceptible to a Prototype Pollution attack:

  • Application server

  • Web server

  • Web browser

How to prevent

  1. Freeze the prototype— use Object.freeze (Object.prototype).

  2. Require schema validation of JSON input.

  3. Avoid using unsafe recursive merge functions.

  4. Consider using objects without prototypes (for example, Object.create(null)), breaking the prototype chain and preventing pollution.

  5. As a best practice use Map instead of Object.

For more information on this vulnerability type:

Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018

Remediation

Upgrade electron to version 39.8.9, 40.9.2, 41.2.2, 42.0.0-beta.4 or higher.

References

Prototype Pollution vulnerability report

critical severity

Out-of-Bounds Write

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@31.7.2.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Out-of-Bounds Write via the V8 engine. An attacker can potentially exploit heap corruption by crafting a malicious HTML page.

Remediation

Upgrade electron to version 31.7.2 or higher.

References

Out-of-Bounds Write vulnerability report

critical severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@39.8.1.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free in the offscreen rendering process when a parent WebContents is destroyed while a child window remains open. An attacker can cause memory corruption or application crash by triggering paint frames on the child window that dereference freed memory.

Note:

This is only exploitable if offscreen rendering is enabled (webPreferences.offscreen: true) and the setWindowOpenHandler permits child windows.

Workaround

This vulnerability can be mitigated by denying child window creation from offscreen renderers in your setWindowOpenHandler, or ensuring child windows are closed before the parent is destroyed.

Remediation

Upgrade electron to version 39.8.1, 40.7.0, 41.0.0 or higher.

References

Use After Free vulnerability report

critical severity
new

Improper Check for Certificate Revocation

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@42.11.16.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Improper Check for Certificate Revocation via the Node.js TLS stack in the main and utility processes, which lacked an equivalent of Chromium's compiled-in SubjectPublicKeyInfo (SPKI) blocklist. A certificate chain containing a blocked SPKI hash that would be rejected in a renderer process is accepted by Node's tls, https, and fetch APIs, allowing a MitM attacker to present a chain built on a revoked or distrusted public key and have it verified successfully.

Remediation

Upgrade electron to version 42.11.16, 43.8.1, 44.9.1, 45.0.0-beta.6 or higher.

References

Improper Check for Certificate Revocation vulnerability report

critical severity
new

Insecure Default Initialization of Resource

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@41.10.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Insecure Default Initialization of Resource via the webpreferences attribute on a <webview> tag, which omitted nodeIntegrationInWorker from the list of security options a guest inherits from its embedder. An attacker who can influence the webpreferences attribute can set nodeIntegrationInWorker on a guest whose embedder has it disabled, granting the guest's dedicated workers a Node.js environment the embedder did not authorize and, with an unsandboxed embedder, dropping the guest out of the sandbox entirely. The same omission affects child windows opened via window.open, where the equivalent inheritance list in guest-window-manager.ts also lacked nodeIntegrationInWorker.

Note: This is only exploitable if the app enables the <webview> tag and the embedder is unsandboxed.

Remediation

Upgrade electron to version 44.0.0-beta.5, 43.4.1, 42.9.2, 41.10.6 or higher.

References

Insecure Default Initialization of Resource vulnerability report

high severity

Heap-based Buffer Overflow

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@26.6.5.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the ANGLE component.

Remediation

Upgrade electron to version 26.6.5, 27.2.2 or higher.

References

Heap-based Buffer Overflow vulnerability report

high severity

Heap-based Buffer Overflow

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@27.3.3.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Heap-based Buffer Overflow via a crafted HTML page. An attacker can potentially exploit heap corruption by deceiving a user to visit a malicious web page.

Remediation

Upgrade electron to version 27.3.3 or higher.

References

Heap-based Buffer Overflow vulnerability report

high severity

Heap-based Buffer Overflow

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@27.3.11.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the ANGLE component. An attacker can potentially exploit heap corruption through a crafted HTML page.

Remediation

Upgrade electron to version 27.3.11, 28.3.1, 29.3.1 or higher.

References

Heap-based Buffer Overflow vulnerability report

high severity

Heap-based Buffer Overflow

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@29.4.3.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Heap-based Buffer Overflow through the WebRTC component. An attacker can cause heap corruption and potentially execute arbitrary code by crafting a malicious HTML page.

Remediation

Upgrade electron to version 29.4.3, 30.1.2 or higher.

References

Heap-based Buffer Overflow vulnerability report

high severity

Improper Access Control

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@31.7.4.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Improper Access Control due to an inappropriate implementation in Extensions. An attacker can bypass site isolation.

Remediation

Upgrade electron to version 31.7.4, 32.2.3 or higher.

References

Improper Access Control vulnerability report

high severity

Improper Restriction of Operations within the Bounds of a Memory Buffer

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@29.3.0.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer due to an inappropriate implementation in the V8 engine. An attacker can potentially perform out of bounds memory access by crafting a malicious HTML page.

Remediation

Upgrade electron to version 29.3.0 or higher.

References

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability report

high severity

Integer Overflow or Wraparound

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@14.2.7.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Integer Overflow or Wraparound due to handle reuse in Mojo.

Remediation

Upgrade electron to version 14.2.7, 15.4.0 or higher.

References

Integer Overflow or Wraparound vulnerability report

high severity

Interger Underflow

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@14.2.5.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Interger Underflow in ANGLE. A remote attacker could potentially exploit heap corruption via a crafted HTML page.

Remediation

Upgrade electron to version 14.2.5, 15.3.6 or higher.

References

Interger Underflow vulnerability report

high severity

Out-of-bounds Read

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@26.6.7.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Out-of-bounds Read allowing a remote attacker to exploit heap corruption via a crafted HTML page.

Note: The Stable channel has been updated to 120.0.6099.234 for Mac devices.

Remediation

Upgrade electron to version 26.6.7 or higher.

References

Out-of-bounds Read vulnerability report

high severity

Out-of-bounds Read

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@29.4.3.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Out-of-bounds Read through the V8 engine. An attacker can access memory locations outside of the intended boundary by crafting a malicious HTML page.

Remediation

Upgrade electron to version 29.4.3 or higher.

References

Out-of-bounds Read vulnerability report

high severity

Out-of-bounds Read

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@31.7.2.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Out-of-bounds Read via a crafted HTML page. An attacker can access memory locations outside the intended boundary by crafting a malicious HTML page that triggers the flaw.

Remediation

Upgrade electron to version 31.7.2 or higher.

References

Out-of-bounds Read vulnerability report

high severity

Out-of-Bounds Write

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@29.4.3.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Out-of-Bounds Write through the Streams API. An attacker can execute arbitrary code within a sandboxed environment by crafting a malicious HTML page.

Remediation

Upgrade electron to version 29.4.3 or higher.

References

Out-of-Bounds Write vulnerability report

high severity

Privilege Context Switching Error

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@29.4.0.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Privilege Context Switching Error in libuv's handling of io_uring operations called before calling setuid(). This allows users to elevate privileges.

PoC

const { spawn } = require('node:child_process');
const process = require('process');

process.env['UV_USE_IO_URING']=1;

process.setuid(400);
const ls = spawn('cmd.exe', [' whoami']);

ls.stdout.on('data', (data) => {
    console.log(`stdout: ${data}`);
  });
  
ls.stderr.on('data', (data) => {
    console.error(`stderr: ${data}`);
  });
  
ls.on('close', (code) => {
    console.log(`child process exited with code ${code}`);
  });

console.log("The user identity of the Node.js" + " process:", process.getuid());

Remediation

Upgrade electron to version 29.4.0 or higher.

References

Privilege Context Switching Error vulnerability report

high severity

Type Confusion

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@13.6.3.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Type Confusion in V8. This allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Remediation

Upgrade electron to version 13.6.3, 14.2.2, 15.3.3 or higher.

References

Type Confusion vulnerability report

high severity

Type Confusion

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@13.6.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Type Confusion in loader in Google Chrome. This can lead to heap corruption which is exploited through a crafted HTML page.

Remediation

Upgrade electron to version 13.6.6, 14.2.4, 15.3.5 or higher.

References

Type Confusion vulnerability report

high severity

Type Confusion

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@13.6.8.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Type Confusion in V8 in Google Chrome allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Remediation

Upgrade electron to version 13.6.8, 14.2.5, 15.3.6 or higher.

References

Type Confusion vulnerability report

high severity

Type Confusion

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@17.4.11.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Type Confusion in V8.

Remediation

Upgrade electron to version 17.4.11, 18.3.6 or higher.

References

Type Confusion vulnerability report

high severity

Type Confusion

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@19.1.5.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Type Confusion in V8.

Remediation

Upgrade electron to version 19.1.5, 20.3.5 or higher.

References

Type Confusion vulnerability report

high severity

Type Confusion

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@29.4.3.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Type Confusion due to the V8 process. An attacker can potentially perform arbitrary read/write by exploiting a crafted HTML page.

Remediation

Upgrade electron to version 29.4.3 or higher.

References

Type Confusion vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@13.6.2.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free via the Web Transport module in Chromium.

Remediation

Upgrade electron to version 14.2.1, 13.6.2 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@13.6.3.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free in loader in Google Chrome. This allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Remediation

Upgrade electron to version 13.6.3, 14.2.2, 15.3.3 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@16.0.0.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free in the storage foundation, which allows a remote attacker to potentially exploit heap corruption via a crafted HTML page

Remediation

Upgrade electron to version 16.0.0 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@15.3.5.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free in media in Google Chrome which allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Remediation

Upgrade electron to version 15.3.5 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@13.6.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free via file API in Google Chrome prior to 96.0.4664.93. It allows a remote attacker who have compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.

Remediation

Upgrade electron to version 13.6.6, 14.2.4, 15.3.5 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@14.2.7.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free on context loss.

Remediation

Upgrade electron to version 14.2.7, 15.4.0, 16.0.10 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@14.2.7.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free when the source framebuffer's extents were accidentally used instead of the blit area extents.

Remediation

Upgrade electron to version 14.2.7, 15.4.0, 16.0.10 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@16.2.4.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free in the BFCache, due to the attempts to cache an interstitial which results in a crash.

Remediation

Upgrade electron to version 16.2.4, 17.4.2 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@15.5.3.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free in regular expressions (V8).

Remediation

Upgrade electron to version 15.5.3, 16.2.4, 17.4.2 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@15.5.4.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free in Angle, when pausing XFB then deleting a buffer.

Remediation

Upgrade electron to version 15.5.4, 16.2.6, 17.4.3 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@15.5.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free in Vulkan.

Remediation

Upgrade electron to version 15.5.6, 16.2.6, 17.4.4 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@16.2.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free in File System API.

Remediation

Upgrade electron to version 16.2.6, 17.4.3, 18.2.2 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@15.5.4.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free in SwiftShader.

Remediation

Upgrade electron to version 15.5.4, 16.2.5, 17.4.3 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@15.5.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free due to improper cache state validation after the XFB buffer was deleted.

Remediation

Upgrade electron to version 15.5.6, 16.2.7, 17.4.5 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@17.4.8.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free in Angle.

Remediation

Upgrade electron to version 17.4.8, 18.3.4 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@18.3.11.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free when glBufferData redefines a buffer and the new buffer is smaller than the old buffer.

Remediation

Upgrade electron to version 18.3.11, 19.0.15 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@18.3.11.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free in Blink, when a DisplayLock is unlocked via ForceUnlockIfNeeded.

Remediation

Upgrade electron to version 18.3.11 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@19.0.15.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free in SwiftShader.

Remediation

Upgrade electron to version 19.0.15 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@18.3.14.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free in WebSQL

Remediation

Upgrade electron to version 18.3.14, 20.1.4 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@18.3.12.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free in WebSQL.

Remediation

Upgrade electron to version 18.3.12, 19.0.16, 20.1.2 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@18.3.14.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free in Layout.

Remediation

Upgrade electron to version 19.1.0, 18.3.14 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@18.3.12.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free in Network Service

Remediation

Upgrade electron to version 20.1.2, 19.1.0, 18.3.12 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@18.3.14.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free in Frames, via a crafted HTML page.

Remediation

Upgrade electron to version 18.3.14, 19.1.0 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@19.1.5.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free in Layout.

Remediation

Upgrade electron to version 19.1.5, 20.3.5 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@19.1.7.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free in WebCodecs, which allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Remediation

Upgrade electron to version 19.1.7, 20.3.7 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@19.1.7.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free via the Web Workers, which allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Remediation

Upgrade electron to version 19.1.7, 20.3.7 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@20.3.9.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free in Mojo, via heap corruption.

Remediation

Upgrade electron to version 20.3.9, 21.4.0 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@20.3.12.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free in WebRTC, causing heap corruption.

Remediation

Upgrade electron to version 20.3.12, 21.4.2 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@26.6.5.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free via the WebAudio component. An attacker can potentially exploit heap corruption by convincing a user to visit a crafted HTML page.

Remediation

Upgrade electron to version 26.6.5, 27.2.2 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@26.6.8.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free via the Web Audio feature. An attacker can potentially exploit heap corruption by crafting a malicious HTML page.

Remediation

Upgrade electron to version 26.6.8, 27.3.1 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@27.3.9.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free due to the improper handling of objects in memory in the Dawn component. An attacker can potentially exploit heap corruption through a crafted HTML page.

Remediation

Upgrade electron to version 27.3.9, 28.2.10, 29.2.0 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@27.3.9.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free due to improper handling in the WebCodecs component. An attacker can achieve arbitrary read/write access by crafting a malicious HTML page.

Remediation

Upgrade electron to version 27.3.9, 28.2.10, 29.2.0 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@27.3.11.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free due to improper handling of objects in memory in the Dawn component. An attacker can cause heap corruption and potentially execute arbitrary code by convincing a user to visit a specially crafted HTML page.

Remediation

Upgrade electron to version 27.3.11, 28.3.1, 29.3.1 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@29.4.3.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free through the Media Session process. An attacker can execute arbitrary code inside a sandbox by crafting a malicious HTML page.

Remediation

Upgrade electron to version 29.4.3 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@29.4.3.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free through the Dawn process. An attacker can potentially exploit heap corruption by crafting a malicious HTML page.

Remediation

Upgrade electron to version 29.4.3 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@29.4.3.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free through the Dawn component. An attacker can potentially exploit heap corruption by crafting a malicious HTML page.

Remediation

Upgrade electron to version 29.4.3 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@29.4.3.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free in the scheduling process. An attacker can execute arbitrary code inside a sandbox by using a crafted HTML page.

Remediation

Upgrade electron to version 29.4.3 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@29.4.3.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free due to the improper handling of memory in the Dawn process. An attacker can cause heap corruption by crafting a malicious HTML page.

Note: 126.0.6478.56 is the fixed version for Windows and Mac. Version 126.0.6478.54 fixes the vulnerability in Linux

Remediation

Upgrade electron to version 29.4.3 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@29.4.3.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free via the Dawn process. An attacker can potentially exploit heap corruption by crafting a malicious HTML page.

Note: 126.0.6478.56 is the fixed version for Windows and Mac. Version 126.0.6478.54 fixes the vulnerability in Linux

Remediation

Upgrade electron to version 29.4.3 or higher.

References

Use After Free vulnerability report

high severity

Access of Resource Using Incompatible Type ('Type Confusion')

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@33.4.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type ('Type Confusion') in v8.

Remediation

Upgrade electron to version 33.4.6, 34.3.4 or higher.

References

Access of Resource Using Incompatible Type ('Type Confusion') vulnerability report

high severity

External Control of Assumed-Immutable Web Parameter

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@31.7.2.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to External Control of Assumed-Immutable Web Parameter via a crafted HTML page. An attacker can perform an out of bounds memory write by sending a specially crafted HTML content.

Remediation

Upgrade electron to version 31.7.2 or higher.

References

External Control of Assumed-Immutable Web Parameter vulnerability report

high severity

Heap-based Buffer Overflow

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@31.7.2.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Heap-based Buffer Overflow in Skia

Remediation

Upgrade electron to version 31.7.2 or higher.

References

Heap-based Buffer Overflow vulnerability report

high severity

Heap-based Buffer Overflow

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@31.7.2.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Heap-based Buffer Overflow in Skia.

Remediation

Upgrade electron to version 31.7.2 or higher.

References

Heap-based Buffer Overflow vulnerability report

high severity

Heap-based Buffer Overflow

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@31.7.2.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Heap-based Buffer Overflow in Skia.

Remediation

Upgrade electron to version 31.7.2 or higher.

References

Heap-based Buffer Overflow vulnerability report

high severity

Hidden Functionality

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@38.8.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Hidden Functionality via the commandLineSwitches webPreference. An attacker can inject arbitrary command-line switches into the renderer process by supplying untrusted configuration objects, potentially disabling security controls or sandboxing.

Note:

This is only exploitable if external or untrusted input is used to construct webPreferences without an explicit allowlist.

Workaround

This vulnerability can be mitigated by not spreading untrusted input into webPreferences and by using an explicit allowlist of permitted preference keys when constructing options from external configuration.

Remediation

Upgrade electron to version 38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.8 or higher.

References

Hidden Functionality vulnerability report

high severity

Incorrect Calculation of Buffer Size

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@37.2.4.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Incorrect Calculation of Buffer Size via insufficient validation of untrusted input in ANGLE and GPU. An attacker can escape the sandbox by submitting a specially crafted HTML page.

Remediation

Upgrade electron to version 37.2.4 or higher.

References

Incorrect Calculation of Buffer Size vulnerability report

high severity

Out-of-bounds Write

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@31.7.7.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Out-of-bounds Write via a crafted HTML page. An attacker can execute arbitrary code inside a sandbox by crafting a malicious HTML page.

Remediation

Upgrade electron to version 31.7.7 or higher.

References

Out-of-bounds Write vulnerability report

high severity

Out-of-bounds Write

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@32.3.0.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Out-of-bounds Write through a crafted HTML page. An attacker can execute arbitrary code inside a sandbox by crafting malicious HTML content.

Remediation

Upgrade electron to version 32.3.0 or higher.

References

Out-of-bounds Write vulnerability report

high severity

Out-of-bounds Write

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@32.3.2.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Out-of-bounds Write via a crafted HTML page. An attacker can potentially exploit heap corruption by sending a specially crafted HTML page to the victim.

Remediation

Upgrade electron to version 32.3.2, 33.4.2 or higher.

References

Out-of-bounds Write vulnerability report

high severity

Out-of-bounds Write

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@32.3.2.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Out-of-bounds Write through crafted HTML pages. An attacker can exploit heap corruption by sending a specially crafted HTML page to the victim.

Remediation

Upgrade electron to version 32.3.2, 33.4.2 or higher.

References

Out-of-bounds Write vulnerability report

high severity

Type Confusion

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@32.3.0.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Type Confusion in v8 engine.

Remediation

Upgrade electron to version 32.3.0 or higher.

References

Type Confusion vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@37.2.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free via MediaStreamTrackImpl. An attacker can cause heap corruption by enticing a user to visit a specially crafted HTML page.

Remediation

Upgrade electron to version 37.2.6 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@29.4.3.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free via the Dawn component.

Remediation

Upgrade electron to version 29.4.3 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@29.4.5.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free through the Swiftshader process. An attacker can potentially exploit heap corruption by crafting a malicious HTML page.

Remediation

Upgrade electron to version 29.4.5, 30.2.0 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@29.4.5.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free through the Dawn process. An attacker can potentially exploit heap corruption by crafting a malicious HTML page.

Remediation

Upgrade electron to version 29.4.5, 30.2.0 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@29.4.5.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free due to the improper handling of memory in the Dawn component. An attacker can cause heap corruption and potentially execute arbitrary code by crafting a malicious HTML page.

Remediation

Upgrade electron to version 29.4.5, 30.2.0 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@29.4.5.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free through the Dawn component. An attacker can potentially exploit heap corruption by crafting a malicious HTML page.

Remediation

Upgrade electron to version 29.4.5, 30.2.0 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@30.4.0.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free in Dawn component. An attacker can potentially exploit heap corruption by crafting a malicious HTML page.

Remediation

Upgrade electron to version 30.4.0, 31.4.0 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@30.4.0.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free in Loader component. An attacker can potentially exploit heap corruption by crafting a malicious HTML page.

Remediation

Upgrade electron to version 30.4.0, 31.4.0 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@31.7.2.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free via the Dawn component. An attacker can potentially exploit heap corruption by crafting a malicious HTML page.

Remediation

Upgrade electron to version 31.7.2 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@31.7.2.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free via the WebAudio process. An attacker can potentially exploit heap corruption by crafting a malicious HTML page.

Remediation

Upgrade electron to version 31.7.2 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@31.7.5.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free via the Serial process. An attacker can potentially exploit heap corruption.

Remediation

Upgrade electron to version 31.7.5, 32.2.5 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@31.7.7.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free via the Compositing process. An attacker can potentially exploit heap corruption by crafting a malicious HTML page.

Remediation

Upgrade electron to version 31.7.7 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@33.4.3.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free through the V8 engine. An attacker can potentially exploit heap corruption by crafting a malicious HTML page.

Remediation

Upgrade electron to version 33.4.3 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@32.3.3.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free through the V8 engine.

Remediation

Upgrade electron to version 32.3.3, 33.4.3 or higher.

References

Use After Free vulnerability report

high severity

Improper Authorization

  • Vulnerable module: http-cache-semantics
  • Introduced through: electron-rebuild@2.3.5, electron@12.2.3 and others

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › got@11.8.6 › cacheable-request@7.0.4 › http-cache-semantics@4.3.0
  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3 › @electron/get@1.14.1 › got@9.6.0 › cacheable-request@6.1.0 › http-cache-semantics@4.3.0
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › update-notifier@5.1.0 › latest-version@5.1.0 › package-json@6.5.0 › got@9.6.0 › cacheable-request@6.1.0 › http-cache-semantics@4.3.0

Overview

Affected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client max-stale directives. An unauthenticated attacker can request the same URL with a large max-stale value to retrieve cached responses belonging to other users, including Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reasons.

Remediation

There is no fixed version for http-cache-semantics.

References

Improper Authorization vulnerability report

high severity

Inefficient Algorithmic Complexity

  • Vulnerable module: minimatch
  • Introduced through: electron-builder@22.14.13

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › app-builder-lib@22.14.13 › @electron/universal@1.0.5 › dir-compare@2.4.0 › minimatch@3.0.4
    Remediation: Upgrade to electron-builder@24.0.0.
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › dmg-builder@22.14.13 › app-builder-lib@22.14.13 › @electron/universal@1.0.5 › dir-compare@2.4.0 › minimatch@3.0.4
    Remediation: Upgrade to electron-builder@24.0.0.

Overview

minimatch is a minimal matching utility.

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the matchOne function. An attacker can cause significant delays in processing and stall the event loop by supplying specially crafted glob patterns containing multiple non-adjacent GLOBSTAR segments.

Remediation

Upgrade minimatch to version 3.1.3, 4.2.5, 5.1.8, 6.2.2, 7.4.8, 8.0.6, 9.0.7, 10.2.3 or higher.

References

Inefficient Algorithmic Complexity vulnerability report

high severity

Regular Expression Denial of Service (ReDoS)

  • Vulnerable module: minimatch
  • Introduced through: electron-builder@22.14.13

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › app-builder-lib@22.14.13 › @electron/universal@1.0.5 › dir-compare@2.4.0 › minimatch@3.0.4
    Remediation: Upgrade to electron-builder@24.0.0.
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › dmg-builder@22.14.13 › app-builder-lib@22.14.13 › @electron/universal@1.0.5 › dir-compare@2.4.0 › minimatch@3.0.4
    Remediation: Upgrade to electron-builder@24.0.0.

Overview

minimatch is a minimal matching utility.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in the AST class, caused by catastrophic backtracking when an input string contains many * characters in a row, followed by an unmatched character.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.

The Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.

Let’s take the following regular expression as an example:

regex = /A(B|C+)+D/

This regular expression accomplishes the following:

  • A The string must start with the letter 'A'
  • (B|C+)+ The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the + matches one or more times). The + at the end of this section states that we can look for one or more matches of this section.
  • D Finally, we ensure this section of the string ends with a 'D'

The expression would match inputs such as ABBD, ABCCCCD, ABCBCCCD and ACCCCCD

It most cases, it doesn't take very long for a regex engine to find a match:

$ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD")'
0.04s user 0.01s system 95% cpu 0.052 total

$ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX")'
1.79s user 0.02s system 99% cpu 1.812 total

The entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.

Most Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as catastrophic backtracking.

Let's look at how our expression runs into this problem, using a shorter string: "ACCCX". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:

  1. CCC
  2. CC+C
  3. C+CC
  4. C+C+C.

The engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use RegEx 101 debugger to see the engine has to take a total of 38 steps before it can determine the string doesn't match.

From there, the number of steps the engine must use to validate a string just continues to grow.

String Number of C's Number of steps
ACCCX 3 38
ACCCCX 4 71
ACCCCCX 5 136
ACCCCCCCCCCCCCCX 14 65,553

By the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.

Remediation

Upgrade minimatch to version 3.1.3, 4.2.4, 5.1.7, 6.2.1, 7.4.7, 8.0.5, 9.0.6, 10.2.1 or higher.

References

Regular Expression Denial of Service (ReDoS) vulnerability report

high severity

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: qs
  • Introduced through: electron-rebuild@2.3.5

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › node-gyp@7.1.2 › request@2.88.2 › qs@6.5.5

Overview

qs is a querystring parser that supports nesting and arrays, with a depth limit.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via improper enforcement of the arrayLimit option in bracket notation parsing. An attacker can exhaust server memory and cause application unavailability by submitting a large number of bracket notation parameters - like a[]=1&a[]=2 - in a single HTTP request.

PoC


const qs = require('qs');
const attack = 'a[]=' + Array(10000).fill('x').join('&a[]=');
const result = qs.parse(attack, { arrayLimit: 100 });
console.log(result.a.length);  // Output: 10000 (should be max 100)

Remediation

Upgrade qs to version 6.14.1 or higher.

References

Allocation of Resources Without Limits or Throttling vulnerability report

high severity

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: tar
  • Introduced through: electron-rebuild@2.3.5

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › lzma-native@6.0.1 › node-pre-gyp@0.11.0 › tar@4.4.19
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › tar@6.2.1
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › node-gyp@7.1.2 › tar@6.2.1

Overview

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts. An attacker can exhaust disk space and CPU resources by submitting a small crafted gzip archive with a high decompression ratio.

Remediation

Upgrade tar to version 7.5.19 or higher.

References

Allocation of Resources Without Limits or Throttling vulnerability report

high severity

Infinite loop

  • Vulnerable module: tar
  • Introduced through: electron-rebuild@2.3.5

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › lzma-native@6.0.1 › node-pre-gyp@0.11.0 › tar@4.4.19
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › tar@6.2.1
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › node-gyp@7.1.2 › tar@6.2.1

Overview

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Infinite loop via the replace method. An attacker can cause the archive scanner to enter an infinite loop by providing a tar header with a negative base-256 encoded entry size.

Remediation

Upgrade tar to version 7.5.18 or higher.

References

Infinite loop vulnerability report

high severity

Infinite loop

  • Vulnerable module: uri-js
  • Introduced through: electron-builder@22.14.13 and electron-rebuild@2.3.5

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › app-builder-lib@22.14.13 › @develar/schema-utils@2.6.5 › ajv@6.15.0 › uri-js@4.4.1
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › dmg-builder@22.14.13 › dmg-license@1.0.11 › ajv@6.15.0 › uri-js@4.4.1
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › dmg-builder@22.14.13 › app-builder-lib@22.14.13 › @develar/schema-utils@2.6.5 › ajv@6.15.0 › uri-js@4.4.1
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › node-gyp@7.1.2 › request@2.88.2 › har-validator@5.1.5 › ajv@6.15.0 › uri-js@4.4.1

Overview

uri-js is a RFC 3986/3987 compliant, scheme extendable URI/IRI parsing/validating/resolving library for JavaScript.

Affected versions of this package are vulnerable to Infinite loop via the removeDotSegments function, which loops infinitely when a path segment begins with Unicode line separators (U+2028) or paragraph separators (U+2029). An attacker can trigger this by passing such a path to removeDotSegments directly, or through the normalize or resolve functions with IRI handling enabled, blocking the Node.js event loop indefinitely until heap exhaustion.

Remediation

There is no fixed version for uri-js.

References

Infinite loop vulnerability report

high severity

Access of Resource Using Incompatible Type ('Type Confusion')

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@37.2.5.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type ('Type Confusion') via lack of support for escapes in PreParserIdentifier V8` process. An attacker can achieve heap corruption by enticing a user to visit a specially crafted HTML page.

Remediation

Upgrade electron to version 37.2.5 or higher.

References

Access of Resource Using Incompatible Type ('Type Confusion') vulnerability report

high severity

Heap-based Buffer Overflow

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@17.4.11.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the WebRTC component.

Remediation

Upgrade electron to version 17.4.11, 18.3.6 or higher.

References

Heap-based Buffer Overflow vulnerability report

high severity

Heap-based Buffer Overflow

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@29.4.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Heap-based Buffer Overflow through the V8 engine. An attacker can corrupt memory and potentially execute arbitrary code by crafting a malicious HTML page.

Note: This is only exploitable if the user navigates to or is redirected to a malicious web page.

Remediation

Upgrade electron to version 29.4.6, 30.4.0 or higher.

References

Heap-based Buffer Overflow vulnerability report

high severity

Out-of-Bounds

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@22.3.23.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Out-of-Bounds when the V8 engine processes a carefully crafted HTML page. An attacker can perform an out of bounds memory read, thereby potentially gaining unauthorized access to sensitive information.

Remediation

Upgrade electron to version 22.3.23, 24.8.2, 25.8.0 or higher.

References

Out-of-Bounds vulnerability report

high severity

Out-of-Bounds

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@27.3.10.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Out-of-Bounds memory access in V8 component. This vulnerability allowed a remote attacker to perform arbitrary read/write via a crafted HTML page.

Remediation

Upgrade electron to version 27.3.10, 28.3.0 or higher.

References

Out-of-Bounds vulnerability report

high severity

Out-of-bounds Read

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@29.4.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Out-of-bounds Read through the V8 engine. An attacker can access memory locations outside of the intended bounds by crafting a malicious HTML page.

Note: This is only exploitable if the user navigates to or is redirected to a malicious web page.

Remediation

Upgrade electron to version 29.4.6, 30.4.0 or higher.

References

Out-of-bounds Read vulnerability report

high severity

Out-of-bounds Write

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@26.6.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Out-of-bounds Write allowing a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Note: The Stable channel has been updated to 120.0.6099.234 for Mac devices.

Remediation

Upgrade electron to version 26.6.6, 27.2.3, 28.1.4 or higher.

References

Out-of-bounds Write vulnerability report

high severity

Out-of-bounds Write

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@31.7.4.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Out-of-bounds Write in Dawn.

Remediation

Upgrade electron to version 31.7.4, 32.2.3 or higher.

References

Out-of-bounds Write vulnerability report

high severity

Type Confusion

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@31.7.1.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Type Confusion in InferHasInPrototypeChain of the V8 engine.

Remediation

Upgrade electron to version 31.7.1, 32.2.1 or higher.

References

Type Confusion vulnerability report

high severity

Type Confusion

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@31.7.2.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Type Confusion via the V8 engine.

Remediation

Upgrade electron to version 31.7.2 or higher.

References

Type Confusion vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@37.2.4.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free via improper handling of possible socket destruction in P2PSocketTcpBase. An attacker can achieve heap corruption and potentially execute arbitrary code by enticing a user to visit a specially crafted HTML page.

Remediation

Upgrade electron to version 37.2.4 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@27.3.4.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free in Mojo runtime libraries collection. This allows an attacker to exploit heap corruption via a crafted HTML page.

Remediation

Upgrade electron to version 27.3.4, 28.2.5 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@29.4.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free through the Audio process. An attacker can potentially exploit heap corruption by crafting a malicious HTML page.

Remediation

Upgrade electron to version 29.4.6, 30.4.0 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@29.4.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free via the Navigation process. An attacker can exploit heap corruption by convincing a user to install a malicious extension.

Remediation

Upgrade electron to version 29.4.6, 30.4.0 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@29.4.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free via specific UI gestures in the Screen Capture feature. An attacker can potentially exploit heap corruption by convincing a user to visit a crafted HTML page.

Remediation

Upgrade electron to version 29.4.6, 30.4.0 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@29.4.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free through the Media Stream process. An attacker can potentially exploit heap corruption by convincing a user to perform specific UI gestures on a crafted HTML page.

Remediation

Upgrade electron to version 29.4.6, 30.4.0 or higher.

References

Use After Free vulnerability report

high severity

Directory Traversal

  • Vulnerable module: extract-zip
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3 › extract-zip@1.7.0

Overview

extract-zip is an unzip a zip file into a directory using 100% javascript

Affected versions of this package are vulnerable to Directory Traversal via the extraction process. An attacker can access or modify arbitrary files by crafting a malicious zip archive containing symlinks that point outside the intended extraction directory.

Details

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

  • Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa

Note %2e is the URL encoded version of . (dot).

  • Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

2018-04-15 22:04:29 .....           19           19  good.txt
2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys

Remediation

There is no fixed version for extract-zip.

References

Directory Traversal vulnerability report

high severity

Improper Access Control

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@23.2.3.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Improper Access Control via nested unserializable return value when using contextIsolation and contextBridge are affected. Exploiting this vulnerability allows code running in the main world context in the renderer to reach into the isolated Electron context and perform privileged actions.

Note

This issue is exploitable under either of two conditions:

  1. If an API exposed to the main world via contextBridge can return an object or array that contains a JS object that cannot be serialized, such as a canvas rendering context. This would normally result in an Error: object could not be cloned exception being thrown.

  2. If an API exposed to the main world via contextBridge has a return value that throws a user-generated exception while being sent over the bridge, such as a dynamic getter property on an object that throws an error when being computed.

Workaround

The app-side workaround is to ensure that such a case, as mentioned in the workaround section, is not possible.

Ensure all values returned from a function exposed over the context bridge are supported and that any objects returned from functions do not have dynamic getters that can throw exceptions.

Auditing your exposed API is likely to be quite difficult, so we strongly recommend you update to a patched version of Electron.

Remediation

Upgrade electron to version 23.2.3, 25.0.0-alpha.2 or higher.

References

Improper Access Control vulnerability report

high severity
new

Incorrect Privilege Assignment

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@41.10.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Incorrect Privilege Assignment via WebContents::OpenURLFromTab in shell/browser/api/electron_api_web_contents.cc, which failed to propagate sandbox flags when a popup was opened by a sandboxed top-level frame. Previously, sandbox flag inheritance was conditional on the initiating frame having a parent, meaning a top-level frame carrying sandbox flags (via a Content-Security-Policy: sandbox header or a sandboxed iframe's popup) could open a new window without those restrictions applied. An attacker controlling content in such a frame can escape the sandbox and gain elevated access to the renderer context, achieving high confidentiality impact and limited integrity impact across the security boundary.

Remediation

Upgrade electron to version 44.0.0-beta.5, 43.4.1, 42.9.2, 41.10.6 or higher.

References

Incorrect Privilege Assignment vulnerability report

high severity
new

Origin Validation Error

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@41.10.4.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Origin Validation Error via the OpenURLFromTab navigation path, when a sandboxed iframe with allow-popups but without allow-popups-to-escape-sandbox opens a new window. The initiating frame's sandbox restrictions are not resolved on this code path because params.frame_tree_node_id is unset for non-CURRENT_TAB dispositions, causing the sandbox check to never run. As a result, the newly created window receives full origin authority instead of inheriting the opener frame's sandbox flags, allowing a sandboxed frame to escape its confinement.

Note: This is only exploitable if the app embeds untrusted content in iframes sandboxed with allow-scripts allow-popups.

Remediation

Upgrade electron to version 41.10.4, 43.0.0, 42.5.2, 45.0.0-alpha.10 or higher.

References

Origin Validation Error vulnerability report

high severity

Directory Traversal

  • Vulnerable module: tar
  • Introduced through: electron-rebuild@2.3.5

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › lzma-native@6.0.1 › node-pre-gyp@0.11.0 › tar@4.4.19
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › tar@6.2.1
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › node-gyp@7.1.2 › tar@6.2.1

Overview

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Directory Traversal via the extract() function. An attacker can read or write files outside the intended extraction directory by causing the application to extract a malicious archive containing a chain of symlinks leading to a hardlink, which bypasses path validation checks.

Details

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

  • Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa

Note %2e is the URL encoded version of . (dot).

  • Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

2018-04-15 22:04:29 .....           19           19  good.txt
2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys

Remediation

Upgrade tar to version 7.5.8 or higher.

References

Directory Traversal vulnerability report

high severity

Origin Validation Error

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@39.8.9.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Origin Validation Error in contextBridge. An attacker can gain access to the isolated preload world and its capabilities by hijacking Function.prototype.bind when Promise-returning functions are exposed to untrusted web content. This may escalate to Node.js access if the renderer is unsandboxed or nodeIntegration is enabled.

Note: This is only exploitable if Promise-returning functions are exposed via contextBridge in windows that load untrusted content.

Remediation

Upgrade electron to version 39.8.9, 40.9.2, 41.2.2, 42.0.0-beta.5 or higher.

References

Origin Validation Error vulnerability report

high severity
new

Origin Validation Error

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@41.10.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Origin Validation Error via the registerFileProtocol and registerHttpProtocol (URLPipeLoader) handlers in ElectronURLLoaderFactory, which fail to apply the opaque response tag to cross-origin mode=no-cors fetch requests. The file and http sinks build or forward their own response head, dropping the opaque tag computed in StartLoading, so the response is delivered as a basic, script-readable response instead of an opaque one. An attacker serving content through a registered custom protocol can read cross-origin responses that should be inaccessible to script.

Note: This is only exploitable if the application registers a custom file or HTTP protocol handler, serves it through one of those handlers, and loads untrusted content.

Remediation

Upgrade electron to version 44.0.0-beta.5, 43.4.1, 42.9.2, 41.10.6 or higher.

References

Origin Validation Error vulnerability report

high severity

Insertion of Sensitive Information Into Sent Data

  • Vulnerable module: builder-util-runtime
  • Introduced through: electron-builder@22.14.13

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › builder-util-runtime@8.9.2
    Remediation: Upgrade to electron-builder@25.1.0.
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › builder-util@22.14.13 › builder-util-runtime@8.9.2
    Remediation: Upgrade to electron-builder@25.1.0.
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › app-builder-lib@22.14.13 › builder-util-runtime@8.9.2
    Remediation: Upgrade to electron-builder@25.1.0.
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › dmg-builder@22.14.13 › builder-util-runtime@8.9.2
    Remediation: Upgrade to electron-builder@25.1.0.
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › app-builder-lib@22.14.13 › builder-util@22.14.13 › builder-util-runtime@8.9.2
    Remediation: Upgrade to electron-builder@25.1.0.
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › dmg-builder@22.14.13 › builder-util@22.14.13 › builder-util-runtime@8.9.2
    Remediation: Upgrade to electron-builder@25.1.0.
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › app-builder-lib@22.14.13 › electron-publish@22.14.13 › builder-util-runtime@8.9.2
    Remediation: Upgrade to electron-builder@25.1.0.
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › dmg-builder@22.14.13 › app-builder-lib@22.14.13 › builder-util-runtime@8.9.2
    Remediation: Upgrade to electron-builder@25.1.0.
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › app-builder-lib@22.14.13 › electron-publish@22.14.13 › builder-util@22.14.13 › builder-util-runtime@8.9.2
    Remediation: Upgrade to electron-builder@25.1.0.
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › dmg-builder@22.14.13 › app-builder-lib@22.14.13 › builder-util@22.14.13 › builder-util-runtime@8.9.2
    Remediation: Upgrade to electron-builder@25.1.0.
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › dmg-builder@22.14.13 › app-builder-lib@22.14.13 › electron-publish@22.14.13 › builder-util-runtime@8.9.2
    Remediation: Upgrade to electron-builder@25.1.0.
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › dmg-builder@22.14.13 › app-builder-lib@22.14.13 › electron-publish@22.14.13 › builder-util@22.14.13 › builder-util-runtime@8.9.2
    Remediation: Upgrade to electron-builder@25.1.0.

Overview

Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the HttpExecutor.prepareRedirectUrlOptions process. An attacker can obtain sensitive credentials, such as GitLab's PRIVATE-TOKEN or mixed-case Authorization headers, by leveraging a cross-origin redirect to an attacker-controlled destination.

Remediation

Upgrade builder-util-runtime to version 9.7.0 or higher.

References

Insertion of Sensitive Information Into Sent Data vulnerability report

high severity

Origin Validation Error

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@39.8.7.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Origin Validation Error in the setPermissionCheckHandler. An attacker can gain unauthorized access to device permissions by embedding a cross-origin iframe and exploiting origin-based permission logic.

Note: This is only exploitable if the application uses origin-based logic in setPermissionCheckHandler and delegates device permissions to cross-origin iframes.

Workaround

This vulnerability can be mitigated by checking details.securityOrigin instead of requestingOrigin for permission decisions, or by not delegating device permissions to untrusted iframes.

Remediation

Upgrade electron to version 39.8.7, 40.9.1, 41.2.0, 42.0.0-beta.1 or higher.

References

Origin Validation Error vulnerability report

high severity

Out-of-bounds Read

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@22.3.5.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Out-of-bounds Read in GPU Video in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Remediation

Upgrade electron to version 22.3.5 or higher.

References

Out-of-bounds Read vulnerability report

high severity

Server-side Request Forgery (SSRF)

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@39.8.8.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the net.fetch or net.request. An attacker can access local file contents by redirecting HTTP requests to local resources and causing the application to return or forward the response body.

Note: This is only exploitable if requests are made to attacker-controlled URLs with redirects followed and the response body is exposed.

Workaround

This vulnerability can be mitigated by setting redirect: 'error' or redirect: 'manual' on requests to untrusted URLs and validating any redirect target before following it.

Remediation

Upgrade electron to version 39.8.8, 40.9.1, 41.2.1, 42.0.0-beta.3 or higher.

References

Server-side Request Forgery (SSRF) vulnerability report

high severity

Origin Validation Error

  • Vulnerable module: http-cache-semantics
  • Introduced through: electron-rebuild@2.3.5, electron@12.2.3 and others

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › got@11.8.6 › cacheable-request@7.0.4 › http-cache-semantics@4.3.0
  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3 › @electron/get@1.14.1 › got@9.6.0 › cacheable-request@6.1.0 › http-cache-semantics@4.3.0
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › update-notifier@5.1.0 › latest-version@5.1.0 › package-json@6.5.0 › got@9.6.0 › cacheable-request@6.1.0 › http-cache-semantics@4.3.0

Overview

Affected versions of this package are vulnerable to Origin Validation Error via the _varyMatches() function, which fails to properly handle Vary: * (wildcard) headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients. The Vary: * directive signals that a response is uncacheable for any other request, but the flawed comparison allows the wildcard to be bypassed, enabling cross-client cache disclosure.

Remediation

There is no fixed version for http-cache-semantics.

References

Origin Validation Error vulnerability report

high severity

Symlink Attack

  • Vulnerable module: tar
  • Introduced through: electron-rebuild@2.3.5

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › lzma-native@6.0.1 › node-pre-gyp@0.11.0 › tar@4.4.19
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › tar@6.2.1
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › node-gyp@7.1.2 › tar@6.2.1

Overview

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Symlink Attack exploitable via stripAbsolutePath(), used by the Unpack class. An attacker can overwrite arbitrary files outside the intended extraction directory by including a hardlink whose linkpath uses a drive-relative path such as C:../target.txt in a malicious tar.

Details

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

  • Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa

Note %2e is the URL encoded version of . (dot).

  • Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

2018-04-15 22:04:29 .....           19           19  good.txt
2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys

Remediation

Upgrade tar to version 7.5.10 or higher.

References

Symlink Attack vulnerability report

high severity

Symlink Attack

  • Vulnerable module: tar
  • Introduced through: electron-rebuild@2.3.5

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › lzma-native@6.0.1 › node-pre-gyp@0.11.0 › tar@4.4.19
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › tar@6.2.1
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › node-gyp@7.1.2 › tar@6.2.1

Overview

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Symlink Attack via tar.x() extraction, which allows an attacker to overwrite arbitrary files outside the intended extraction directory with a drive-relative symlink target - like C:../../../target.txt.

PoC


const fs = require('fs')
const path = require('path')
const { Header, x } = require('tar')

const cwd = process.cwd()
const target = path.resolve(cwd, '..', 'target.txt')
const tarFile = path.join(cwd, 'poc.tar')

fs.writeFileSync(target, 'ORIGINAL\n')

const b = Buffer.alloc(1536)
new Header({
  path: 'a/b/l',
  type: 'SymbolicLink',
  linkpath: 'C:../../../target.txt',
}).encode(b, 0)
fs.writeFileSync(tarFile, b)

x({ cwd, file: tarFile }).then(() => {
  fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\n')
  process.stdout.write(fs.readFileSync(target, 'utf8'))
})

Details

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

  • Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa

Note %2e is the URL encoded version of . (dot).

  • Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

2018-04-15 22:04:29 .....           19           19  good.txt
2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys

Remediation

Upgrade tar to version 7.5.11 or higher.

References

Symlink Attack vulnerability report

high severity

Out-of-bounds Write

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@27.3.11.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Out-of-bounds Write in the Compositing process. An attacker can potentially perform a sandbox escape by exploiting specific UI gestures. This is only exploitable if the attacker has already compromised the GPU process.

Remediation

Upgrade electron to version 27.3.11, 28.3.1, 29.3.1 or higher.

References

Out-of-bounds Write vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@26.6.5.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free via the WebGPU process. An attacker can potentially exploit heap corruption by crafting a malicious HTML page.

Remediation

Upgrade electron to version 26.6.5, 27.2.2 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@26.6.5.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free via the ANGLE component. An attacker can potentially exploit heap corruption by convincing a user to visit a crafted HTML page.

Remediation

Upgrade electron to version 26.6.5, 27.2.2 or higher.

References

Use After Free vulnerability report

high severity

Function Call with Incorrectly Specified Arguments

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@36.3.0.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Function Call with Incorrectly Specified Arguments via an incorrect handle provided in unspecified circumstances in Mojo. An attacker can reflect a broker-initiated transport back to a broker, which ultimately allows for handle leaks if the reflected transport is later used to deserialize another transport containing handles.

Remediation

Upgrade electron to version 36.3.0 or higher.

References

Function Call with Incorrectly Specified Arguments vulnerability report

high severity

Improper Input Validation

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@25.9.4.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Improper Input Validation in the USB component.

Remediation

Upgrade electron to version 25.9.4, 26.5.0, 27.0.4 or higher.

References

Improper Input Validation vulnerability report

high severity

Integer Overflow or Wraparound

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@25.9.4.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the USB component.

Remediation

Upgrade electron to version 25.9.4, 26.5.0, 27.0.4 or higher.

References

Integer Overflow or Wraparound vulnerability report

high severity

NULL Pointer Dereference

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@27.3.8.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to NULL Pointer Dereference in V8, due to an object lifecycle issue involving scope inheritance.

Remediation

Upgrade electron to version 27.3.8, 28.2.9, 29.1.6 or higher.

References

NULL Pointer Dereference vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@16.0.10.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free via the Animation component in Chromium.

Remediation

Upgrade electron to version 16.0.10, 17.1.0 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@19.1.7.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free in V8, which allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Remediation

Upgrade electron to version 19.1.7, 20.3.7 or higher.

References

Use After Free vulnerability report

high severity

Denial of Service (DoS)

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@17.4.11.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Denial of Service (DoS) in PDF in Google Chrome, a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

  • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

  • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade electron to version 17.4.11, 18.3.7 or higher.

References

Denial of Service (DoS) vulnerability report

high severity

Denial of Service (DoS)

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@18.3.14.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Denial of Service (DoS) due to insufficient validation of untrusted input in V8.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

  • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

  • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade electron to version 18.3.14 or higher.

References

Denial of Service (DoS) vulnerability report

high severity

Denial of Service (DoS)

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@19.1.7.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Denial of Service (DoS) due to type confusion in V8, which allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Remediation

Upgrade electron to version 19.1.7, 20.3.7 or higher.

References

Denial of Service (DoS) vulnerability report

high severity

Denial of Service (DoS)

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@27.3.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Denial of Service (DoS) via an Out of bounds memory access in V8.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

  • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

  • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade electron to version 27.3.6, 28.2.7, 29.1.2 or higher.

References

Denial of Service (DoS) vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@38.8.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free via the session.setPermissionRequestHandler process. An attacker can cause a crash or memory corruption by triggering a permission request for fullscreen, pointer-lock, or keyboard-lock, and then navigating the requesting frame or closing the window while the permission handler is pending.

Note:

This is only exploitable if an asynchronous permission request handler is registered and invoked while the request is pending.

Workaround

This vulnerability can be mitigated by responding to permission requests synchronously, or by denying fullscreen, pointer-lock, and keyboard-lock requests if an asynchronous flow is required.

Remediation

Upgrade electron to version 38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.8 or higher.

References

Use After Free vulnerability report

high severity

Improper Isolation or Compartmentalization

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@38.8.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization in the handling of the nodeIntegrationInWorker configuration in shared renderer processes. An attacker can gain unauthorized access to Node.js integration by exploiting process-sharing scenarios where workers in frames configured with nodeIntegrationInWorker: false still receive Node.js integration.

Note:

This is only exploitable if nodeIntegrationInWorker is enabled in applications that also open child windows or embed content with differing webPreferences.

Workaround

This vulnerability can be mitigated by avoiding the enabling of nodeIntegrationInWorker in applications that open child windows or embed content with different webPreferences.

Remediation

Upgrade electron to version 38.8.6, 39.8.4, 40.8.4, 41.0.0 or higher.

References

Improper Isolation or Compartmentalization vulnerability report

high severity

Uncontrolled Search Path Element

  • Vulnerable module: app-builder-bin
  • Introduced through: electron-builder@22.14.13

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › builder-util@22.14.13 › app-builder-bin@3.7.1
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › app-builder-lib@22.14.13 › builder-util@22.14.13 › app-builder-bin@3.7.1
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › dmg-builder@22.14.13 › builder-util@22.14.13 › app-builder-bin@3.7.1
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › app-builder-lib@22.14.13 › electron-publish@22.14.13 › builder-util@22.14.13 › app-builder-bin@3.7.1
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › dmg-builder@22.14.13 › app-builder-lib@22.14.13 › builder-util@22.14.13 › app-builder-bin@3.7.1
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › dmg-builder@22.14.13 › app-builder-lib@22.14.13 › electron-publish@22.14.13 › builder-util@22.14.13 › app-builder-bin@3.7.1

Overview

app-builder-bin is an app-builder precompiled binaries

Affected versions of this package are vulnerable to Uncontrolled Search Path Element through the execWine/executeAppBuilder command path in builder-util and app-builder-lib on non-Windows systems. An attacker can execute attacker-controlled binaries by influencing the Windows tool runner used for packaging and verification, such as when the build process launches Wine-backed helper commands for installer creation or app verification. The affected code invokes the bundled app-builder-bin helper and Wine toolchain to run packaging utilities and test installers, so a malicious or compromised build input can cause the build host to run arbitrary commands during artifact generation. This can compromise the build machine and tamper with generated installers and packages.

Notes

  • The legacy toolsets.wine = "0.0.0" path is only used on macOS; Linux falls back to the system wine binary instead of the bundled Mac bundle.

Workarounds

  • Set LD_LIBRARY_PATH to a non-empty value before launching the AppImage, so the runtime path concatenation does not add the current working directory to the dynamic linker search path.
  • Avoid running vulnerable AppImage files from world-writable directories such as /tmp, so an attacker cannot place a malicious shared library in the launch directory.

Remediation

There is no fixed version for app-builder-bin.

References

Uncontrolled Search Path Element vulnerability report

high severity

Uncontrolled Search Path Element

  • Vulnerable module: app-builder-lib
  • Introduced through: electron-builder@22.14.13

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › app-builder-lib@22.14.13
    Remediation: Upgrade to electron-builder@26.15.0.
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › dmg-builder@22.14.13 › app-builder-lib@22.14.13
    Remediation: Upgrade to electron-builder@26.15.0.

Overview

app-builder-lib is an electron-builder lib

Affected versions of this package are vulnerable to Uncontrolled Search Path Element through the execWine/executeAppBuilder command path in builder-util and app-builder-lib on non-Windows systems. An attacker can execute attacker-controlled binaries by influencing the Windows tool runner used for packaging and verification, such as when the build process launches Wine-backed helper commands for installer creation or app verification. The affected code invokes the bundled app-builder-bin helper and Wine toolchain to run packaging utilities and test installers, so a malicious or compromised build input can cause the build host to run arbitrary commands during artifact generation. This can compromise the build machine and tamper with generated installers and packages.

Notes

  • The legacy toolsets.wine = "0.0.0" path is only used on macOS; Linux falls back to the system wine binary instead of the bundled Mac bundle.

Workarounds

  • Set LD_LIBRARY_PATH to a non-empty value before launching the AppImage, so the runtime path concatenation does not add the current working directory to the dynamic linker search path.
  • Avoid running vulnerable AppImage files from world-writable directories such as /tmp, so an attacker cannot place a malicious shared library in the launch directory.

Remediation

Upgrade app-builder-lib to version 26.15.0 or higher.

References

Uncontrolled Search Path Element vulnerability report

high severity

Untrusted Search Path

  • Vulnerable module: app-builder-lib
  • Introduced through: electron-builder@22.14.13

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › app-builder-lib@22.14.13
    Remediation: Upgrade to electron-builder@24.13.2.
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › dmg-builder@22.14.13 › app-builder-lib@22.14.13
    Remediation: Upgrade to electron-builder@24.13.2.

Overview

app-builder-lib is an electron-builder lib

Affected versions of this package are vulnerable to Untrusted Search Path due to the NSIS installer making a system call to open cmd.exe via NSExec in the .nsh installer script. An attacker can place a malicious executable file named cmd.exe in the same folder as the installer, the installer will run the malicious file.

Notes:

  1. This is only exploitable on Windows machines.

  2. NSExec by default searches the current directory of where the installer is located before searching PATH.

Remediation

Upgrade app-builder-lib to version 24.13.2 or higher.

References

Untrusted Search Path vulnerability report

high severity

Heap-based Buffer Overflow

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@13.5.2.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Heap-based Buffer Overflow via the Blink module in Chromium.

Remediation

Upgrade electron to version 14.2.0, 13.5.2 or higher.

References

Heap-based Buffer Overflow vulnerability report

high severity

Heap-based Buffer Overflow

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@16.2.5.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Heap-based Buffer Overflow in WebGPU.

Remediation

Upgrade electron to version 16.2.5, 17.4.3 or higher.

References

Heap-based Buffer Overflow vulnerability report

high severity

Heap-based Buffer Overflow

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@15.5.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Heap-based Buffer Overflow in V8 Internationalization.

Remediation

Upgrade electron to version 15.5.6, 16.2.7, 17.4.5 or higher.

References

Heap-based Buffer Overflow vulnerability report

high severity

Heap-based Buffer Overflow

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@19.1.7.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Heap-based Buffer Overflow in Crashpad in Google Chrome on Android, which allows a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

Remediation

Upgrade electron to version 19.1.7, 20.3.7 or higher.

References

Heap-based Buffer Overflow vulnerability report

high severity

Heap-based Buffer Overflow

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@20.3.10.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Heap-based Buffer Overflow in Network Service via a crafted HTML page and specific interactions.

Remediation

Upgrade electron to version 20.3.10, 21.3.5 or higher.

References

Heap-based Buffer Overflow vulnerability report

high severity

Heap-based Buffer Overflow

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@21.4.4.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Heap-based Buffer Overflow in Metrics by allowing a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.

Remediation

Upgrade electron to version 21.4.4, 22.3.5 or higher.

References

Heap-based Buffer Overflow vulnerability report

high severity

Heap-based Buffer Overflow

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@22.3.25.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Heap-based Buffer Overflow in vp8 encoding in libvpx.

Remediation

Upgrade electron to version 22.3.25, 24.8.5, 25.8.4, 26.2.4, 27.0.0-beta.8 or higher.

References

Heap-based Buffer Overflow vulnerability report

high severity

Heap-based Buffer Overflow

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@26.6.3.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the WebRTC framework, used to provide Real-Time Communications (RTC) capabilities via JavaScript APIs.

Remediation

Upgrade electron to version 26.6.3, 27.2.0, 28.1.0 or higher.

References

Heap-based Buffer Overflow vulnerability report

high severity

Heap-based Buffer Overflow

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@29.4.3.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the ANGLE process. An attacker can perform an out of bounds memory read via a crafted HTML page.

Remediation

Upgrade electron to version 29.4.3 or higher.

References

Heap-based Buffer Overflow vulnerability report

high severity

Heap-based Buffer Overflow

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@29.4.3.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the Dawn process. An attacker can perform an out of bounds memory write by exploiting a crafted HTML page.

Remediation

Upgrade electron to version 29.4.3 or higher.

References

Heap-based Buffer Overflow vulnerability report

high severity

Improper Check or Handling of Exceptional Conditions

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@14.2.7.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Improper Check or Handling of Exceptional Conditions which returns an invalid handle after ReportBadMessage

Remediation

Upgrade electron to version 14.2.7, 15.4.0, 16.0.10 or higher.

References

Improper Check or Handling of Exceptional Conditions vulnerability report

high severity

Improper Input Validation

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@15.5.4.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Improper Input Validation in Blink Editing.

Remediation

Upgrade electron to version 15.5.4, 16.2.6, 17.4.3, 18.2.2 or higher.

References

Improper Input Validation vulnerability report

high severity

Inappropriate implementation

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@15.5.5.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Inappropriate implementation in Input.

Remediation

Upgrade electron to version 15.5.5, 16.2.6, 17.4.4, 18.2.2 or higher.

References

Inappropriate implementation vulnerability report

high severity

Type Confusion

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@15.5.0.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Type Confusion due to mishandling of interceptors which can lead to out-of-bounds memory access.

Remediation

Upgrade electron to version 15.5.0, 16.2.0 or higher.

References

Type Confusion vulnerability report

high severity

Type Confusion

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@15.5.3.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Type Confusion in V8.

Remediation

Upgrade electron to version 15.5.3, 16.2.3, 17.4.1 or higher.

References

Type Confusion vulnerability report

high severity

Type Confusion

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@26.6.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Type Confusion due to a type confusion in V8. A remote attacker could exploit heap corruption via a crafted HTML page.

Note: The Stable channel has been updated to 120.0.6099.234 for Mac devices.

Remediation

Upgrade electron to version 26.6.6, 27.2.3, 28.1.4 or higher.

References

Type Confusion vulnerability report

high severity

Unquoted Search Path or Element

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@38.8.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Unquoted Search Path or Element in the app.setLoginItemSettings function on Windows when the executable path is written to the Run registry key without proper quoting. An attacker can execute arbitrary code at login by placing a malicious executable in an ancestor directory if the application is installed to a path containing spaces and the attacker has write access to that directory.

Note:

This is only exploitable if the application is installed in a non-standard location where ancestor directories are not protected against unauthorized writes.

Workaround

This vulnerability can be mitigated by installing the application to a path without spaces or to a location where all ancestor directories are protected against unauthorized writes.

Remediation

Upgrade electron to version 38.8.6, 39.8.1, 40.8.0, 41.0.0-beta.8 or higher.

References

Unquoted Search Path or Element vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@13.6.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free in V8.

Remediation

Upgrade electron to version 13.6.6, 14.2.4 or higher.

References

Use After Free vulnerability report

high severity

Improper Encoding or Escaping of Output

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@39.8.7.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the mode parameter of the openDevTools function. An attacker can execute arbitrary JavaScript code in the DevTools context by supplying unsanitized input to this parameter, potentially gaining access to Node.js APIs if the application is running in an unsandboxed configuration.

Note: This is only exploitable if untrusted input can reach the mode argument of openDevTools() or if untrusted content can call openDevTools() on an embedded <webview>.

Workaround

This vulnerability can be mitigated by only passing fixed, allowlisted values (right, bottom, undocked, detach) as the DevTools mode, and by not exposing openDevTools to untrusted content.

Remediation

Upgrade electron to version 39.8.7, 40.9.1, 41.2.0, 42.0.0-beta.1 or higher.

References

Improper Encoding or Escaping of Output vulnerability report

high severity

Time-of-check Time-of-use (TOCTOU) Race Condition

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@39.8.8.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition via the parent process code-sign verification on macOS. An attacker can execute arbitrary code within the context of a signed application by bypassing the code-sign check from a local process, potentially inheriting sensitive permissions and keychain access.

Note: This is only exploitable if fuse-based hardening restricting ELECTRON_RUN_AS_NODE and NODE_OPTIONS to same-signed parents is enabled.

Remediation

Upgrade electron to version 39.8.8, 40.9.1, 41.2.1, 42.0.0-beta.3 or higher.

References

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability report

high severity

Directory Traversal

  • Vulnerable module: extract-zip
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3 › extract-zip@1.7.0

Overview

extract-zip is an unzip a zip file into a directory using 100% javascript

Affected versions of this package are vulnerable to Directory Traversal through the archive extraction logic in index.js. An attacker can write a file outside the destination directory by supplying an archive with two entries that reuse the same path: a symlink pointing outside the extraction root, followed by a regular file for that same name. During extraction, the code only checked the parent directory of each entry and then wrote the file through the existing final path component, so the second entry followed the planted symlink and overwrote the symlink target. This can corrupt or replace files writable by the process running extract-zip.

Details

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

  • Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa

Note %2e is the URL encoded version of . (dot).

  • Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

2018-04-15 22:04:29 .....           19           19  good.txt
2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys

Remediation

A fix was pushed into the master branch but not yet published.

References

Directory Traversal vulnerability report

high severity

Command Injection

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@38.8.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Command Injection in the app.moveToApplicationsFolder function on macOS when handling application bundle paths containing certain characters. An attacker can execute arbitrary AppleScript code by crafting a malicious launch path and convincing a user to accept the move-to-Applications prompt.

Note:

This is only exploitable if the application calls app.moveToApplicationsFolder().

Remediation

Upgrade electron to version 38.8.6, 39.8.1, 40.8.0, 41.0.0-beta.8 or higher.

References

Command Injection vulnerability report

high severity

Out-of-bounds Read

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@22.3.16.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Out-of-bounds Read in WebRTC, exploitable via a crafted HTML page.

Remediation

Upgrade electron to version 22.3.16 or higher.

References

Out-of-bounds Read vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@38.8.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free in the powerMonitor function. An attacker can cause memory corruption or application crashes by triggering session-change events on Windows or system shutdown events on macOS after the native object has been garbage-collected, leading to dereferencing of freed memory.

Remediation

Upgrade electron to version 38.8.6, 39.8.1, 40.8.0, 41.0.0-beta.8 or higher.

References

Use After Free vulnerability report

high severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@26.6.3.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free via the Media Stream process. An attacker can potentially exploit heap corruption by crafting a malicious HTML page.

Remediation

Upgrade electron to version 26.6.3, 27.2.0 or higher.

References

Use After Free vulnerability report

high severity

Out-of-bounds Read

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@31.7.2.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Out-of-bounds Read in Skia.

Remediation

Upgrade electron to version 31.7.2, 32.2.2 or higher.

References

Out-of-bounds Read vulnerability report

medium severity

Access of Resource Using Incompatible Type ('Type Confusion')

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@31.7.4.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type ('Type Confusion') via a crafted HTML page. An attacker can potentially exploit heap corruption.

Remediation

Upgrade electron to version 31.7.4, 32.2.3 or higher.

References

Access of Resource Using Incompatible Type ('Type Confusion') vulnerability report

medium severity

Access of Resource Using Incompatible Type ('Type Confusion')

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@32.2.3.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type ('Type Confusion') via a crafted HTML page. An attacker can potentially exploit heap corruption.

Remediation

Upgrade electron to version 32.2.3 or higher.

References

Access of Resource Using Incompatible Type ('Type Confusion') vulnerability report

medium severity

Access Restriction Bypass

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@31.7.5.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Access Restriction Bypass due to an inappropriate implementation in the Extensions feature. An attacker can bypass site isolation.

Remediation

Upgrade electron to version 31.7.5, 32.2.5, 33.2.1 or higher.

References

Access Restriction Bypass vulnerability report

medium severity

Command Injection

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@39.8.9.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Command Injection in the DevTools embedder handler. An attacker can execute arbitrary files outside the sandbox by leveraging the "reveal in file manager" action to launch the target file, provided they have a means to run scripts inside the DevTools frontend, such as through a malicious DevTools extension.

Note: This is only exploitable if DevTools is opened for windows exposed to untrusted content or untrusted DevTools extensions.

Workaround

This vulnerability can be mitigated by not opening DevTools for windows that load untrusted content and not loading untrusted DevTools extensions.

Remediation

Upgrade electron to version 39.8.9, 40.9.2, 41.2.1, 42.0.0-beta.3 or higher.

References

Command Injection vulnerability report

medium severity

Heap-based Buffer Overflow

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@31.7.2.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Heap-based Buffer Overflow in Fonts.

Remediation

Upgrade electron to version 31.7.2 or higher.

References

Heap-based Buffer Overflow vulnerability report

medium severity

Heap-based Buffer Overflow

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@31.7.2.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Heap-based Buffer Overflow through the V8 engine.

Remediation

Upgrade electron to version 31.7.2 or higher.

References

Heap-based Buffer Overflow vulnerability report

medium severity

Heap-based Buffer Overflow

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@32.3.2.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Heap-based Buffer Overflow in v8, when processing a very large number of parameters.

Remediation

Upgrade electron to version 32.3.2, 33.4.2 or higher.

References

Heap-based Buffer Overflow vulnerability report

medium severity

Improper Isolation or Compartmentalization

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@33.4.8.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization that allows an attacker who can convince a user to follow a malicious link to escape sandbox protections, due to a logic error in the Mojo component. This vulnerability does not enable code execution on its own, but is presumed chainable with another vulnerability to achieve code execution and has been observed in the wild.

Note: This vulnerability is only exploitable on Windows.

Remediation

Upgrade electron to version 33.4.8, 34.4.1, 35.1.2 or higher.

References

Improper Isolation or Compartmentalization vulnerability report

medium severity

Integer Overflow or Wraparound

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@37.2.4.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Integer Overflow or Wraparound via an incorrect count being passed to InstructionAccurateScope in the V8 engine. An attacker can cause heap corruption by enticing a user to visit a specially crafted HTML page.

Remediation

Upgrade electron to version 37.2.4 or higher.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Type Confusion

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@31.7.2.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Type Confusion. An attacker can access memory locations outside of the intended bounds by crafting a malicious HTML page that triggers type confusion in the V8 engine.

Remediation

Upgrade electron to version 31.7.2 or higher.

References

Type Confusion vulnerability report

medium severity

CRLF Injection

  • Vulnerable module: form-data
  • Introduced through: electron-rebuild@2.3.5

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › node-gyp@7.1.2 › request@2.88.2 › form-data@2.3.3

Overview

Affected versions of this package are vulnerable to CRLF Injection via the _multiPartHeader function when untrusted input is provided via field or filename to FormData#append. An attacker can inject additional headers or multipart parts by including carriage returns, line feeds, or double quotes in the input. This can allow the modification or addition of form fields visible to downstream parsers.

PoC

const FormData = require('form-data');
const form = new FormData();
form.append('email"\r\nX-Injected: true\r\nfake="', 'user@example.com');
console.log(form.getBuffer().toString());

Remediation

Upgrade form-data to version 2.5.6, 3.0.5, 4.0.6 or higher.

References

CRLF Injection vulnerability report

medium severity

Uncaught Exception

  • Vulnerable module: qs
  • Introduced through: electron-rebuild@2.3.5

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › node-gyp@7.1.2 › request@2.88.2 › qs@6.5.5

Overview

qs is a querystring parser that supports nesting and arrays, with a depth limit.

Affected versions of this package are vulnerable to Uncaught Exception in the isBuffer() function in lib/utils.js, which calls obj.constructor.isBuffer(obj) without checking that it is callable, reached from stringify() at lib/stringify.js:127. An attacker can throw an uncaught TypeError that fails each request with HTTP 500, and terminates the worker process when stringify() runs in an unguarded async context, by supplying a query string such as x[constructor][isBuffer]=y that sets constructor.isBuffer to a non-function value. This requires the application to call qs.parse() with plainObjects: true or allowPrototypes: true, which preserves the constructor own property, and to then pass the parsed result to qs.stringify().

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

  • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

  • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade qs to version 6.16.0 or higher.

References

Uncaught Exception vulnerability report

medium severity

Incorrect Type Conversion or Cast

  • Vulnerable module: tar
  • Introduced through: electron-rebuild@2.3.5

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › lzma-native@6.0.1 › node-pre-gyp@0.11.0 › tar@4.4.19
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › tar@6.2.1
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › node-gyp@7.1.2 › tar@6.2.1

Overview

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Incorrect Type Conversion or Cast via the src/pax.ts file. An attacker can cause a process crash by providing all-digit PAX path or linkpath values that are coerced to JavaScript numbers, leading to a TypeError during downstream path handling.

Remediation

Upgrade tar to version 7.5.18 or higher.

References

Incorrect Type Conversion or Cast vulnerability report

medium severity

Interpretation Conflict

  • Vulnerable module: tar
  • Introduced through: electron-rebuild@2.3.5

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › lzma-native@6.0.1 › node-pre-gyp@0.11.0 › tar@4.4.19
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › tar@6.2.1
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › node-gyp@7.1.2 › tar@6.2.1

Overview

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Interpretation Conflict due to improper handling of PAX extended header size overrides in intermediary metadata headers. An attacker can cause inconsistent archive parsing results between different tar implementations by crafting a malicious tar archive that desynchronizes the parser's interpretation, potentially hiding files from scanners or extractors that rely on different tools.

Remediation

Upgrade tar to version 7.5.16 or higher.

References

Interpretation Conflict vulnerability report

medium severity

Uncaught Exception

  • Vulnerable module: tar
  • Introduced through: electron-rebuild@2.3.5

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › lzma-native@6.0.1 › node-pre-gyp@0.11.0 › tar@4.4.19
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › tar@6.2.1
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › node-gyp@7.1.2 › tar@6.2.1

Overview

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Uncaught Exception through improper handling of NUL bytes in the src/pax.ts file. An attacker can cause the application to terminate unexpectedly by providing a crafted archive containing NUL bytes in PAX path or linkpath records, which leads to an uncaught exception when these values are passed to filesystem operations.

Remediation

Upgrade tar to version 7.5.17 or higher.

References

Uncaught Exception vulnerability report

medium severity

Uncontrolled Recursion

  • Vulnerable module: tar
  • Introduced through: electron-rebuild@2.3.5

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › lzma-native@6.0.1 › node-pre-gyp@0.11.0 › tar@4.4.19
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › tar@6.2.1
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › node-gyp@7.1.2 › tar@6.2.1

Overview

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Uncontrolled Recursion in the mapHas helper and filesFilter function in src/list.ts, which walk an entry path upward with one path.dirname() call per recursion and no segment cap. An attacker can terminate the Node process with an uncatchable stack-overflow RangeError by supplying a tar archive whose GNU L or PAX x long-path header carries tens of thousands of /-separated segments, when that archive is listed or extracted with a member-selection filter. Exploitation requires the application to call tar.t() or tar.x() with a non-empty member-selection list on an untrusted archive, and on async or streaming consumers the error is uncatchable while synchronous APIs can catch it.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

  • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

  • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade tar to version 7.5.21 or higher.

References

Uncontrolled Recursion vulnerability report

medium severity

Improper Encoding or Escaping of Output

  • Vulnerable module: uri-js
  • Introduced through: electron-builder@22.14.13 and electron-rebuild@2.3.5

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › app-builder-lib@22.14.13 › @develar/schema-utils@2.6.5 › ajv@6.15.0 › uri-js@4.4.1
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › dmg-builder@22.14.13 › dmg-license@1.0.11 › ajv@6.15.0 › uri-js@4.4.1
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › dmg-builder@22.14.13 › app-builder-lib@22.14.13 › @develar/schema-utils@2.6.5 › ajv@6.15.0 › uri-js@4.4.1
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › node-gyp@7.1.2 › request@2.88.2 › har-validator@5.1.5 › ajv@6.15.0 › uri-js@4.4.1

Overview

uri-js is a RFC 3986/3987 compliant, scheme extendable URI/IRI parsing/validating/resolving library for JavaScript.

Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via pctDecChars(), which decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. An attacker can craft percent-encoded payloads to bypass platform decoder validation and inject path traversal or CRLF sequences that downstream consumers process without filtering.

Remediation

There is no fixed version for uri-js.

References

Improper Encoding or Escaping of Output vulnerability report

medium severity

Integer Overflow or Wraparound

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@27.3.11.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Integer Overflow or Wraparound when decoding videos with a large frame size. An attacker can cause memory corruption within the AV1 decoder by providing a specially crafted video file.

Remediation

Upgrade electron to version 27.3.11, 28.3.1 or higher.

References

Integer Overflow or Wraparound vulnerability report

medium severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@16.2.0.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free via Angle, where base level changes may not update FBO completeness check.

Remediation

Upgrade electron to version 16.2.0 or higher.

References

Use After Free vulnerability report

medium severity

Improper Input Validation

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@15.5.0.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Improper Input Validation which allows attackers who have control over a given app's update server or update storage to serve maliciously crafted update packages that pass the code signing validation check but contain malicious code in some components.

Remediation

Upgrade electron to version 15.5.0, 16.2.0, 17.2.0, 18.0.0 or higher.

References

Improper Input Validation vulnerability report

medium severity

Domain Spoofing

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@16.0.0.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Domain Spoofing via a crafted HTML page as a result of inappropriate implementation in navigation in Google Chrome.

Remediation

Upgrade electron to version 16.0.0 or higher.

References

Domain Spoofing vulnerability report

medium severity

Improper Input Validation

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@17.4.8.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Improper Input Validation in Data Transfer, because the sanitization code only does one round of parsing and serializing.

Remediation

Upgrade electron to version 17.4.8, 18.3.5 or higher.

References

Improper Input Validation vulnerability report

medium severity

Inappropriate Implementation

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@13.6.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Inappropriate Implementation via cache in Google Chrome. This allows a remote attacker to leak cross-origin data via a crafted HTML page.

Remediation

Upgrade electron to version 13.6.6, 14.2.2, 15.3.3 or higher.

References

Inappropriate Implementation vulnerability report

medium severity

Server-side Request Forgery (SSRF)

  • Vulnerable module: request
  • Introduced through: electron-rebuild@2.3.5

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › node-gyp@7.1.2 › request@2.88.2

Overview

request is a simplified http request client.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) due to insufficient checks in the lib/redirect.js file by allowing insecure redirects in the default configuration, via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP).

NOTE: request package has been deprecated, so a fix is not expected. See https://github.com/request/request/issues/3142.

Remediation

A fix was pushed into the master branch but not yet published.

References

Server-side Request Forgery (SSRF) vulnerability report

medium severity

Uncontrolled Resource Consumption ('Resource Exhaustion')

  • Vulnerable module: tar
  • Introduced through: electron-rebuild@2.3.5

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › lzma-native@6.0.1 › node-pre-gyp@0.11.0 › tar@4.4.19

Overview

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Uncontrolled Resource Consumption ('Resource Exhaustion') due to the lack of folders count validation during the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running the software and even crash the client within few seconds of running it using a path with too many sub-folders inside.

Remediation

Upgrade tar to version 6.2.1 or higher.

References

Uncontrolled Resource Consumption ('Resource Exhaustion') vulnerability report

medium severity

Prototype Pollution

  • Vulnerable module: tough-cookie
  • Introduced through: electron-rebuild@2.3.5

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › node-gyp@7.1.2 › request@2.88.2 › tough-cookie@2.5.0

Overview

tough-cookie is a RFC6265 Cookies and CookieJar module for Node.js.

Affected versions of this package are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. Due to an issue with the manner in which the objects are initialized, an attacker can expose or modify a limited amount of property information on those objects. There is no impact to availability.

PoC

// PoC.js
async function main(){
var tough = require("tough-cookie");
var cookiejar = new tough.CookieJar(undefined,{rejectPublicSuffixes:false});
// Exploit cookie
await cookiejar.setCookie(
  "Slonser=polluted; Domain=__proto__; Path=/notauth",
  "https://__proto__/admin"
);
// normal cookie
var cookie = await cookiejar.setCookie(
  "Auth=Lol; Domain=google.com; Path=/notauth",
  "https://google.com/"
);

//Exploit cookie
var a = {};
console.log(a["/notauth"]["Slonser"])
}
main();

Details

Prototype Pollution is a vulnerability affecting JavaScript. Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects. JavaScript allows all Object attributes to be altered, including their magical attributes such as __proto__, constructor and prototype. An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. Properties on the Object.prototype are then inherited by all the JavaScript objects through the prototype chain. When that happens, this leads to either denial of service by triggering JavaScript exceptions, or it tampers with the application source code to force the code path that the attacker injects, thereby leading to remote code execution.

There are two main ways in which the pollution of prototypes occurs:

  • Unsafe Object recursive merge

  • Property definition by path

Unsafe Object recursive merge

The logic of a vulnerable recursive merge function follows the following high-level model:

merge (target, source)

  foreach property of source

    if property exists and is an object on both the target and the source

      merge(target[property], source[property])

    else

      target[property] = source[property]

When the source object contains a property named __proto__ defined with Object.defineProperty() , the condition that checks if the property exists and is an object on both the target and the source passes and the merge recurses with the target, being the prototype of Object and the source of Object as defined by the attacker. Properties are then copied on the Object prototype.

Clone operations are a special sub-class of unsafe recursive merges, which occur when a recursive merge is conducted on an empty object: merge({},source).

lodash and Hoek are examples of libraries susceptible to recursive merge attacks.

Property definition by path

There are a few JavaScript libraries that use an API to define property values on an object based on a given path. The function that is generally affected contains this signature: theFunction(object, path, value)

If the attacker can control the value of “path”, they can set this value to __proto__.myValue. myValue is then assigned to the prototype of the class of the object.

Types of attacks

There are a few methods by which Prototype Pollution can be manipulated:

Type Origin Short description
Denial of service (DoS) Client This is the most likely attack.
DoS occurs when Object holds generic functions that are implicitly called for various operations (for example, toString and valueOf).
The attacker pollutes Object.prototype.someattr and alters its state to an unexpected value such as Int or Object. In this case, the code fails and is likely to cause a denial of service.
For example: if an attacker pollutes Object.prototype.toString by defining it as an integer, if the codebase at any point was reliant on someobject.toString() it would fail.
Remote Code Execution Client Remote code execution is generally only possible in cases where the codebase evaluates a specific attribute of an object, and then executes that evaluation.
For example: eval(someobject.someattr). In this case, if the attacker pollutes Object.prototype.someattr they are likely to be able to leverage this in order to execute code.
Property Injection Client The attacker pollutes properties that the codebase relies on for their informative value, including security properties such as cookies or tokens.
For example: if a codebase checks privileges for someuser.isAdmin, then when the attacker pollutes Object.prototype.isAdmin and sets it to equal true, they can then achieve admin privileges.

Affected environments

The following environments are susceptible to a Prototype Pollution attack:

  • Application server

  • Web server

  • Web browser

How to prevent

  1. Freeze the prototype— use Object.freeze (Object.prototype).

  2. Require schema validation of JSON input.

  3. Avoid using unsafe recursive merge functions.

  4. Consider using objects without prototypes (for example, Object.create(null)), breaking the prototype chain and preventing pollution.

  5. As a best practice use Map instead of Object.

For more information on this vulnerability type:

Arteau, Olivier. “JavaScript prototype pollution attack in NodeJS application.” GitHub, 26 May 2018

Remediation

Upgrade tough-cookie to version 4.1.3 or higher.

References

Prototype Pollution vulnerability report

medium severity

Improper Handling of Unicode Encoding

  • Vulnerable module: tar
  • Introduced through: electron-rebuild@2.3.5

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › lzma-native@6.0.1 › node-pre-gyp@0.11.0 › tar@4.4.19
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › tar@6.2.1
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › node-gyp@7.1.2 › tar@6.2.1

Overview

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Improper Handling of Unicode Encoding in Path Reservations via Unicode Sharp-S (ß) Collisions on macOS APFS. An attacker can overwrite arbitrary files by exploiting Unicode normalization collisions in filenames within a malicious tar archive on case-insensitive or normalization-insensitive filesystems.

Note:

This is only exploitable if the system is running on a filesystem such as macOS APFS or HFS+ that ignores Unicode normalization.

Workaround

This vulnerability can be mitigated by filtering out all SymbolicLink entries when extracting tarball data.

PoC

const tar = require('tar');
const fs = require('fs');
const path = require('path');
const { PassThrough } = require('stream');

const exploitDir = path.resolve('race_exploit_dir');
if (fs.existsSync(exploitDir)) fs.rmSync(exploitDir, { recursive: true, force: true });
fs.mkdirSync(exploitDir);

console.log('[*] Testing...');
console.log(`[*] Extraction target: ${exploitDir}`);

// Construct stream
const stream = new PassThrough();

const contentA = 'A'.repeat(1000);
const contentB = 'B'.repeat(1000);

// Key 1: "f_ss"
const header1 = new tar.Header({
    path: 'collision_ss',
    mode: 0o644,
    size: contentA.length,
});
header1.encode();

// Key 2: "f_ß"
const header2 = new tar.Header({
    path: 'collision_ß',
    mode: 0o644,
    size: contentB.length,
});
header2.encode();

// Write to stream
stream.write(header1.block);
stream.write(contentA);
stream.write(Buffer.alloc(512 - (contentA.length % 512))); // Padding

stream.write(header2.block);
stream.write(contentB);
stream.write(Buffer.alloc(512 - (contentB.length % 512))); // Padding

// End
stream.write(Buffer.alloc(1024));
stream.end();

// Extract
const extract = new tar.Unpack({
    cwd: exploitDir,
    // Ensure jobs is high enough to allow parallel processing if locks fail
    jobs: 8 
});

stream.pipe(extract);

extract.on('end', () => {
    console.log('[*] Extraction complete');

    // Check what exists
    const files = fs.readdirSync(exploitDir);
    console.log('[*] Files in exploit dir:', files);
    files.forEach(f => {
        const p = path.join(exploitDir, f);
        const stat = fs.statSync(p);
        const content = fs.readFileSync(p, 'utf8');
        console.log(`File: ${f}, Inode: ${stat.ino}, Content: ${content.substring(0, 10)}... (Length: ${content.length})`);
    });

    if (files.length === 1 || (files.length === 2 && fs.statSync(path.join(exploitDir, files[0])).ino === fs.statSync(path.join(exploitDir, files[1])).ino)) {
        console.log('\[*] GOOD');
    } else {
        console.log('[-] No collision');
    }
});

Remediation

Upgrade tar to version 7.5.4 or higher.

References

Improper Handling of Unicode Encoding vulnerability report

medium severity

External Control of System or Configuration Setting

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@39.8.8.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to External Control of System or Configuration Setting via the window.open. An attacker can cause the main process to access attacker-controlled file or network paths by supplying malicious window options in the features string.

Note: This is only exploitable if untrusted content can invoke window.open and the application does not override child window options using setWindowOpenHandler or explicitly set overrideBrowserWindowOptions.

Workaround

This vulnerability can be mitigated by returning { action: 'deny' } from setWindowOpenHandler for untrusted content, or by supplying overrideBrowserWindowOptions to explicitly set every window option.

Remediation

Upgrade electron to version 39.8.8, 40.9.1, 41.2.1, 42.0.0-beta.3 or higher.

References

External Control of System or Configuration Setting vulnerability report

medium severity

Improper Input Validation

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@19.1.5.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Improper Input Validation in file system.

Remediation

Upgrade electron to version 19.1.5, 21.2.2 or higher.

References

Improper Input Validation vulnerability report

medium severity

Improper Restriction of Rendered UI Layers or Frames

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@39.8.10.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Improper Restriction of Rendered UI Layers or Frames in the OpenURL navigation path, which allows a sandboxed iframe without the allow-popups keyword to open a new window or trigger setWindowOpenHandler without user interaction. An attacker can circumvent intended popup restrictions by embedding untrusted content in a sandboxed iframe and leveraging this navigation path.

Note: This is only exploitable if applications rely solely on the absence of allow-popups in the iframe sandbox to prevent window creation.

Workaround

This vulnerability can be mitigated by returning { action: 'deny' } from setWindowOpenHandler for any content that is not trusted.

Remediation

Upgrade electron to version 39.8.10, 41.10.3, 42.0.1 or higher.

References

Improper Restriction of Rendered UI Layers or Frames vulnerability report

medium severity

Incorrect Permission Assignment for Critical Resource

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@39.8.8.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource via the openExternal. An attacker can cause an OS-registered external application to be launched by sending requests from sandboxed iframes that are not properly restricted.

Note: This is only exploitable if untrusted content is rendered in sandboxed iframes and the openExternal permission is granted (which is the default unless a custom permission handler is installed).

Workaround

This vulnerability can be mitigated by installing a setPermissionRequestHandler that denies the openExternal permission for untrusted content.

Remediation

Upgrade electron to version 39.8.8, 40.9.1, 41.2.1, 42.0.0-beta.3 or higher.

References

Incorrect Permission Assignment for Critical Resource vulnerability report

medium severity
new

Origin Validation Error

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@42.11.3.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Origin Validation Error via ElectronHidDelegate and ElectronUsbDelegate, which performed HID and USB permission checks with a null frame and the top-level document's origin instead of the requesting subframe's origin. When a cross-origin iframe requests a HID or USB device, session.setPermissionCheckHandler receives the top-level origin, no requestingUrl, isMainFrame: false, and a null webContents, causing origin-based permission logic to evaluate the wrong principal. An attacker controlling a cross-origin subframe embedded in a page that grants HID or USB access can bypass the intended per-frame permission check and gain device access that should be denied.

Note: This is only exploitable if setPermissionCheckHandler is used with origin-based logic for hid or usb and cross-origin iframes are embedded with allow="hid" or allow="usb".

Remediation

Upgrade electron to version 42.11.3, 43.7.0, 44.3.0, 45.0.0-alpha.5 or higher.

References

Origin Validation Error vulnerability report

medium severity
new

Origin Validation Error

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@42.11.3.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Origin Validation Error via incorrect attribution of the requesting origin in HandleExternalProtocolInUI when handling openExternal permission requests. When a navigation to an external protocol involves a detached initiator frame or a server-side redirect, the requestingUrl reported to the permission manager is taken from the navigating WebContents' committed URL rather than the actual initiating or redirecting origin. An attacker who controls untrusted content can trigger an openExternal navigation such that the permission check is evaluated against a trusted origin the attacker does not control, bypassing origin-based openExternal restrictions.

Note: Apps are only affected if they grant openExternal based on the requesting origin and allow untrusted content to open or navigate windows.

Remediation

Upgrade electron to version 45.0.0-alpha.5, 44.3.0, 43.7.0, 42.11.3 or higher.

References

Origin Validation Error vulnerability report

medium severity

Type Confusion

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@15.5.3.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Type Confusion in V8.

Remediation

Upgrade electron to version 15.5.3, 16.2.4, 17.4.2 or higher.

References

Type Confusion vulnerability report

medium severity

Improper Validation of Specified Index, Position, or Offset in Input

  • Vulnerable module: uuid
  • Introduced through: electron-rebuild@2.3.5

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › node-gyp@7.1.2 › request@2.88.2 › uuid@3.4.0

Overview

uuid is a RFC4122 (v1, v4, and v5) compliant UUID library.

Affected versions of this package are vulnerable to Improper Validation of Specified Index, Position, or Offset in Input due to accepting external output buffers but not rejecting out-of-range writes (small buf or large offset). This inconsistency allows silent partial writes into caller-provided buffers.

PoC

cd /home/StrawHat/uuid
npm ci
npm run build

node --input-type=module -e "
import {v4,v5,v6} from './dist-node/index.js';
const ns='6ba7b810-9dad-11d1-80b4-00c04fd430c8';
for (const [name,fn] of [
  ['v4',()=>v4({},new Uint8Array(8),4)],
  ['v5',()=>v5('x',ns,new Uint8Array(8),4)],
  ['v6',()=>v6({},new Uint8Array(8),4)],
]) {
  try { fn(); console.log(name,'NO_THROW'); }
  catch(e){ console.log(name,'THREW',e.name); }
}"

Remediation

Upgrade uuid to version 11.1.1, 14.0.0 or higher.

References

Improper Validation of Specified Index, Position, or Offset in Input vulnerability report

medium severity

Race Condition

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@29.4.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Race Condition via a crafted Chrome Extension. An attacker who convinced a user to install a malicious extension can inject scripts or HTML into a privileged page.

Remediation

Upgrade electron to version 29.4.6, 30.4.0 or higher.

References

Race Condition vulnerability report

medium severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@27.3.5.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free via the xmlTextReader module. An attacker can cause denial of service by processing crafted XML documents with DTD validation and XInclude expansion enabled.

Remediation

Upgrade electron to version 27.3.5, 28.2.6 or higher.

References

Use After Free vulnerability report

medium severity

Missing Release of Resource after Effective Lifetime

  • Vulnerable module: inflight
  • Introduced through: electron-rebuild@2.3.5 and electron-builder@22.14.13

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › node-gyp@7.1.2 › glob@7.2.3 › inflight@1.0.6
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › lzma-native@6.0.1 › rimraf@2.7.1 › glob@7.2.3 › inflight@1.0.6
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › node-gyp@7.1.2 › rimraf@3.0.2 › glob@7.2.3 › inflight@1.0.6
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › app-builder-lib@22.14.13 › @electron/universal@1.0.5 › asar@3.2.0 › glob@7.2.3 › inflight@1.0.6
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › lzma-native@6.0.1 › node-pre-gyp@0.11.0 › rimraf@2.7.1 › glob@7.2.3 › inflight@1.0.6
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › dmg-builder@22.14.13 › app-builder-lib@22.14.13 › @electron/universal@1.0.5 › asar@3.2.0 › glob@7.2.3 › inflight@1.0.6

Overview

Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via the makeres function due to improperly deleting keys from the reqs object after execution of callbacks. This behavior causes the keys to remain in the reqs object, which leads to resource exhaustion.

Exploiting this vulnerability results in crashing the node process or in the application crash.

Note: This library is not maintained, and currently, there is no fix for this issue. To overcome this vulnerability, several dependent packages have eliminated the use of this library.

To trigger the memory leak, an attacker would need to have the ability to execute or influence the asynchronous operations that use the inflight module within the application. This typically requires access to the internal workings of the server or application, which is not commonly exposed to remote users. Therefore, “Attack vector” is marked as “Local”.

PoC

const inflight = require('inflight');

function testInflight() {
  let i = 0;
  function scheduleNext() {
    let key = `key-${i++}`;
    const callback = () => {
    };
    for (let j = 0; j < 1000000; j++) {
      inflight(key, callback);
    }

    setImmediate(scheduleNext);
  }


  if (i % 100 === 0) {
    console.log(process.memoryUsage());
  }

  scheduleNext();
}

testInflight();

Remediation

There is no fixed version for inflight.

References

Missing Release of Resource after Effective Lifetime vulnerability report

medium severity

Directory Traversal

  • Vulnerable module: tar
  • Introduced through: electron-rebuild@2.3.5

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › lzma-native@6.0.1 › node-pre-gyp@0.11.0 › tar@4.4.19
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › tar@6.2.1
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › node-gyp@7.1.2 › tar@6.2.1

Overview

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Directory Traversal via processing of hardlinks. An attacker can read or overwrite arbitrary files on the file system by crafting a malicious TAR archive that bypasses path traversal protections during extraction.

Details

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

  • Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa

Note %2e is the URL encoded version of . (dot).

  • Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

2018-04-15 22:04:29 .....           19           19  good.txt
2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys

Remediation

Upgrade tar to version 7.5.7 or higher.

References

Directory Traversal vulnerability report

medium severity

Insufficient Verification of Data Authenticity

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@22.3.24.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity when the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses are enabled.

An attacker can edit files inside the .app bundle on macOS, which these fuses are supposed to protect against, by gaining write access to the filesystem from which the app is launched.

Note

This is only exploitable if your app is launched from a filesystem the attacker has write access to and is specific to macOS, as these fuses are only supported on macOS.

Remediation

Upgrade electron to version 22.3.24, 24.8.3, 25.8.1, 26.2.1 or higher.

References

Insufficient Verification of Data Authenticity vulnerability report

medium severity

Insufficient Verification of Data Authenticity

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@38.8.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the webContents.executeJavaScript function. An attacker can manipulate the main-process promise to resolve with attacker-controlled data by spoofing reply messages on the internal IPC channel.

Note:

This is only exploitable if service workers are registered and the result of webContents.executeJavaScript() or webFrameMain.executeJavaScript() is used in security-sensitive decisions.

Workaround

This vulnerability can be mitigated by not trusting the return value of webContents.executeJavaScript() for security decisions and using dedicated, validated IPC channels for security-relevant communication with renderers.

Remediation

Upgrade electron to version 38.8.6, 39.8.1, 40.8.1, 41.0.0 or higher.

References

Insufficient Verification of Data Authenticity vulnerability report

medium severity

Permissive Cross-domain Policy with Untrusted Domains

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@39.8.10.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains via the custom protocol handler when supportFetchAPI is enabled but corsEnabled is not set. An attacker can access sensitive data from a custom scheme by performing cross-origin requests from a remote origin.

Note: This is only exploitable if an application registers a custom scheme with supportFetchAPI: true and corsEnabled: false, and loads remote or untrusted content in a renderer.

Workaround

This vulnerability can be mitigated by setting corsEnabled: true on custom schemes and validating the request Origin in the protocol handler before returning sensitive data.

Remediation

Upgrade electron to version 39.8.10, 40.9.3, 41.4.0, 42.0.0 or higher.

References

Permissive Cross-domain Policy with Untrusted Domains vulnerability report

medium severity

Directory Traversal

  • Vulnerable module: tar
  • Introduced through: electron-rebuild@2.3.5

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › lzma-native@6.0.1 › node-pre-gyp@0.11.0 › tar@4.4.19
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › tar@6.2.1
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › node-gyp@7.1.2 › tar@6.2.1

Overview

tar is a full-featured Tar for Node.js.

Affected versions of this package are vulnerable to Directory Traversal via insufficient sanitization of the linkpath parameter during archive extraction. An attacker can overwrite arbitrary files or create malicious symbolic links by crafting a tar archive with hardlink or symlink entries that resolve outside the intended extraction directory.

PoC

const fs = require('fs')
const path = require('path')
const tar = require('tar')

const out = path.resolve('out_repro')
const secret = path.resolve('secret.txt')
const tarFile = path.resolve('exploit.tar')
const targetSym = '/etc/passwd'

// Cleanup & Setup
try { fs.rmSync(out, {recursive:true, force:true}); fs.unlinkSync(secret) } catch {}
fs.mkdirSync(out)
fs.writeFileSync(secret, 'ORIGINAL_DATA')

// 1. Craft malicious Link header (Hardlink to absolute local file)
const h1 = new tar.Header({
  path: 'exploit_hard',
  type: 'Link',
  size: 0,
  linkpath: secret 
})
h1.encode()

// 2. Craft malicious Symlink header (Symlink to /etc/passwd)
const h2 = new tar.Header({
  path: 'exploit_sym',
  type: 'SymbolicLink',
  size: 0,
  linkpath: targetSym 
})
h2.encode()

// Write binary tar
fs.writeFileSync(tarFile, Buffer.concat([ h1.block, h2.block, Buffer.alloc(1024) ]))

console.log('[*] Extracting malicious tarball...')

// 3. Extract with default secure settings
tar.x({
  cwd: out,
  file: tarFile,
  preservePaths: false
}).then(() => {
  console.log('[*] Verifying payload...')

  // Test Hardlink Overwrite
  try {
    fs.writeFileSync(path.join(out, 'exploit_hard'), 'OVERWRITTEN')
    
    if (fs.readFileSync(secret, 'utf8') === 'OVERWRITTEN') {
      console.log('[+] VULN CONFIRMED: Hardlink overwrite successful')
    } else {
      console.log('[-] Hardlink failed')
    }
  } catch (e) {}

  // Test Symlink Poisoning
  try {
    if (fs.readlinkSync(path.join(out, 'exploit_sym')) === targetSym) {
      console.log('[+] VULN CONFIRMED: Symlink points to absolute path')
    } else {
      console.log('[-] Symlink failed')
    }
  } catch (e) {}
})

Details

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

  • Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa

Note %2e is the URL encoded version of . (dot).

  • Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

2018-04-15 22:04:29 .....           19           19  good.txt
2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys

Remediation

Upgrade tar to version 7.5.3 or higher.

References

Directory Traversal vulnerability report

medium severity

Access Control Bypass

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@18.3.9.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Access Control Bypass due to insufficient policy enforcement in Cookies.

Remediation

Upgrade electron to version 18.3.9, 19.0.12 or higher.

References

Access Control Bypass vulnerability report

medium severity

Exposure of Data Element to Wrong Session

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@39.8.8.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Exposure of Data Element to Wrong Session via the extension tab and scripting APIs not being properly scoped to the extension's own session. An attacker can access, navigate, and read data from windows belonging to a different session by loading a malicious or compromised extension.

Note: This is only exploitable if Chrome extensions are loaded via session.loadExtension and the application relies on separate sessions to isolate extensions from other content.

Workaround

This vulnerability can be mitigated by only loading extensions from trusted sources and not relying solely on session separation for isolation.

Remediation

Upgrade electron to version 39.8.8, 40.9.1, 41.2.1, 42.0.0-beta.3 or higher.

References

Exposure of Data Element to Wrong Session vulnerability report

medium severity

HTTP Response Splitting

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@38.8.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to HTTP Response Splitting via the protocol.handle, protocol.registerSchemesAsPrivileged, or webRequest.onHeadersReceived functions. An attacker can manipulate HTTP response headers by injecting attacker-controlled input into a response header name or value, potentially allowing the setting of arbitrary headers that affect cookies, content security policy, or cross-origin access controls.

Note:

This is only exploitable if untrusted external input is reflected into response headers.

Workaround

This vulnerability can be mitigated by validating or sanitizing any untrusted input before including it in a response header name or value.

Remediation

Upgrade electron to version 38.8.6, 39.8.3, 40.8.3, 41.0.3 or higher.

References

HTTP Response Splitting vulnerability report

medium severity

Out-of-bounds Read

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@39.8.10.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Out-of-bounds Read in the paint event image generation process when offscreen rendering is enabled. An attacker can cause memory disclosure or application crash by compromising the GPU process and sending malicious frame data to the main process.

Note: This is only exploitable if offscreen rendering (webPreferences.offscreen) is enabled and the attacker has already achieved code execution in the GPU process.

Remediation

Upgrade electron to version 39.8.10, 40.9.1, 41.2.1, 42.0.0-beta.3 or higher.

References

Out-of-bounds Read vulnerability report

medium severity

Protection Mechanism Failure

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@17.4.9.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Protection Mechanism Failure in File System API.

Remediation

Upgrade electron to version 17.4.9, 18.3.6, 19.0.7 or higher.

References

Protection Mechanism Failure vulnerability report

medium severity

Information Exposure

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@18.3.7.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Information Exposure in that it reveals hashed credentials when the target of a redirect is an SMB URL, such as one using the file:// scheme.

NOTE: This vulnerability is only exploitable on Windows.

Workaround

This vulnerability can be worked around by preventing redirects to file:// URLs in the WebContents.on('will-redirect') event.

Remediation

Upgrade electron to version 18.3.7, 19.0.11, 20.0.1 or higher.

References

Information Exposure vulnerability report

medium severity

Out-of-bounds Read

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@38.8.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Out-of-bounds Read in the second-instance event handler when parsing a crafted second-instance message via the app.requestSingleInstanceLock process. An attacker can access sensitive memory contents or cause application instability by sending a specially crafted message from another process running as the same user.

Note:

This is only exploitable if the application calls app.requestSingleInstanceLock() and is running on macOS or Linux as the same user.

Remediation

Upgrade electron to version 38.8.6, 39.8.1, 40.8.1, 41.0.0 or higher.

References

Out-of-bounds Read vulnerability report

medium severity

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@38.8.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in the app.setAsDefaultProtocolClient function. An attacker can gain the ability to write to arbitrary registry subkeys by supplying a crafted protocol name derived from untrusted input. This may allow hijacking of existing protocol handlers.

Note:

This is only exploitable if the protocol name passed to app.setAsDefaultProtocolClient is not hardcoded and is instead derived from external or untrusted sources.

Workaround

This vulnerability can be mitigated by validating the protocol name matches the regular expression /^[a-zA-Z][a-zA-Z0-9+.-]*$/ before passing it to app.setAsDefaultProtocolClient().

Remediation

Upgrade electron to version 38.8.6, 39.8.1, 40.8.1, 41.0.0 or higher.

References

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability report

medium severity

Use After Free

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@38.8.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Use After Free in the download save dialog callback process. An attacker can cause a crash or memory corruption by triggering session destruction while a native save-file dialog is open and then dismissing the dialog.

Note:

This is only exploitable if the application allows downloads and programmatically destroys sessions at runtime.

Workaround

This vulnerability can be mitigated by avoiding session destruction while a download save dialog may be open and by canceling pending downloads before tearing down sessions.

Remediation

Upgrade electron to version 38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.7 or higher.

References

Use After Free vulnerability report

medium severity

Buffer Overflow

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@18.3.8.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Buffer Overflow when changing the PDF layout confuses AddFindResult() and causes it to fail a DCHECK()

Remediation

Upgrade electron to version 18.3.8, 19.0.13 or higher.

References

Buffer Overflow vulnerability report

medium severity

Improper Control of a Resource Through its Lifetime

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@13.6.8.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Improper Control of a Resource Through its Lifetime in the FramebufferAttachment::mRenderToTextureSamples method in Angle. It was never updated if the renderbuffer storage was changed after attaching to framebuffer.

Remediation

Upgrade electron to version 13.6.8, 14.2.4, 15.3.6 or higher.

References

Improper Control of a Resource Through its Lifetime vulnerability report

medium severity

Inappropriate implementation

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@16.2.5.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Inappropriate implementation in WebGL.

Remediation

Upgrade electron to version 16.2.5, 17.4.3 or higher.

References

Inappropriate implementation vulnerability report

medium severity

Inappropriate implementation

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@15.5.4.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Inappropriate implementation in Web Cursor.

Remediation

Upgrade electron to version 15.5.4, 16.2.3, 17.4.1 or higher.

References

Inappropriate implementation vulnerability report

medium severity

Inappropriate Implementation

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@14.2.2.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Inappropriate Implementation via service workers in Google Chrome. This allows a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.

Remediation

Upgrade electron to version 14.2.2, 15.3.3 or higher.

References

Inappropriate Implementation vulnerability report

medium severity

Exposure of Resource to Wrong Sphere

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@15.5.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere which allows a renderer with JS execution to obtain access to a new renderer process even without nodeIntegrationInSubFrames being enabled, that allows effective access to ipcRenderer.

Remediation

Upgrade electron to version 15.5.6, 16.2.6, 17.2.0, 18.0.0 or higher.

References

Exposure of Resource to Wrong Sphere vulnerability report

medium severity

Heap-based Buffer Overflow

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@28.3.2.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Heap-based Buffer Overflow. The nativeImage.createFromPath or nativeImage.createFromBuffer APIs in Electron, which make use of Chromium's JPEGCodec::Decode, are vulnerable to a heap-based buffer overflow. An attacker can execute arbitrary code or cause a crash by supplying specially crafted image data.

Remediation

Upgrade electron to version 28.3.2, 29.3.3, 30.0.3 or higher.

References

Heap-based Buffer Overflow vulnerability report

medium severity
new

Time-of-check Time-of-use (TOCTOU) Race Condition

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@39.8.10.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition via the Squirrel.Mac installer component (SQRLInstaller), where the target bundle URL read from a serialized request on disk is re-evaluated at multiple points in the install signal chain rather than being resolved once to a canonical path. A local attacker can substitute a symlink between validation and use steps, redirecting a privileged install to an arbitrary location and achieving arbitrary code execution or full compromise of confidentiality, integrity, and availability.

Note: This is only exploitable on macOS in applications that ship Squirrel.Mac-based auto-updates.

Remediation

Upgrade electron to version 42.0.0-beta.2, 41.10.5, 39.8.10 or higher.

References

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability report

medium severity

Open Redirect

  • Vulnerable module: got
  • Introduced through: electron@12.2.3 and electron-builder@22.14.13

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3 › @electron/get@1.14.1 › got@9.6.0
    Remediation: Upgrade to electron@22.0.0.
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › update-notifier@5.1.0 › latest-version@5.1.0 › package-json@6.5.0 › got@9.6.0
    Remediation: Upgrade to electron-builder@23.5.0.

Overview

Affected versions of this package are vulnerable to Open Redirect due to missing verification of requested URLs. It allowed a victim to be redirected to a UNIX socket.

Remediation

Upgrade got to version 11.8.5, 12.1.0 or higher.

References

Open Redirect vulnerability report

medium severity

Improper Input Validation

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@18.3.8.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Improper Input Validation. in Internals, due to not treating % as a special character in pathname resolution.

NOTE: This vulnerability is only exploitable when running on Windows.

Remediation

Upgrade electron to version 18.3.8, 19.0.13 or higher.

References

Improper Input Validation vulnerability report

medium severity

Improper Neutralization of Null Byte or NUL Character

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@39.8.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Improper Neutralization of Null Byte or NUL Character via the shell.openPath function. An attacker can bypass file path validation by supplying a path containing an embedded null byte, which may result in opening a different file than intended.

Note: This is only exploitable if paths derived from untrusted input are passed to shell.openPath and only string-based validation is performed without a filesystem check.

Workaround

This vulnerability can be mitigated by rejecting any path containing a null byte before passing it to shell.openPath.

Remediation

Upgrade electron to version 39.8.6, 40.9.1, 41.1.1, 42.0.0-beta.1 or higher.

References

Improper Neutralization of Null Byte or NUL Character vulnerability report

medium severity

Information Exposure

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@14.2.8.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Information Exposure where ImageBitmaps that is created by webGL contexts will fail to render.

Remediation

Upgrade electron to version 14.2.8, 15.4.2, 16.2.0 or higher.

References

Information Exposure vulnerability report

medium severity

Information Exposure

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@18.3.9.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Information Exposure in Background Fetch, by exposing URLs during cross-origin redirects.

Remediation

Upgrade electron to version 18.3.9, 19.0.12 or higher.

References

Information Exposure vulnerability report

medium severity
new

Origin Validation Error

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@42.11.9.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Origin Validation Error via misattribution of pointerLock permission requests from in-process iframes. When a same-site, cross-origin iframe calls Element.requestPointerLock(), the permission request handler receives the local root's URL and isMainFrame value instead of the requesting iframe's, because the request is routed through the widget of the local root rather than the actual requesting frame. An attacker controlling a cross-origin iframe can thereby impersonate the parent frame's origin in the app's setPermissionRequestHandler, bypassing origin-based permission checks for pointer lock.

Note: This is only exploitable if the app embeds untrusted content in iframes and decides pointerLock requests by origin in setPermissionRequestHandler.

Remediation

Upgrade electron to version 42.11.9, 43.7.6, 44.5.0, 45.0.0-alpha.13 or higher.

References

Origin Validation Error vulnerability report

medium severity

Type Confusion

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@29.4.3.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Type Confusion via a crafted HTML page in the V8 engine.

**Note: ** This is only exploitable if the user navigates to or is redirected to the malicious page.

Remediation

Upgrade electron to version 29.4.3 or higher.

References

Type Confusion vulnerability report

medium severity

Regular Expression Denial of Service (ReDoS)

  • Vulnerable module: minimatch
  • Introduced through: electron-builder@22.14.13

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › app-builder-lib@22.14.13 › @electron/universal@1.0.5 › dir-compare@2.4.0 › minimatch@3.0.4
    Remediation: Upgrade to electron-builder@24.0.0.
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › dmg-builder@22.14.13 › app-builder-lib@22.14.13 › @electron/universal@1.0.5 › dir-compare@2.4.0 › minimatch@3.0.4
    Remediation: Upgrade to electron-builder@24.0.0.

Overview

minimatch is a minimal matching utility.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the braceExpand function in minimatch.js.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.

The Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.

Let’s take the following regular expression as an example:

regex = /A(B|C+)+D/

This regular expression accomplishes the following:

  • A The string must start with the letter 'A'
  • (B|C+)+ The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the + matches one or more times). The + at the end of this section states that we can look for one or more matches of this section.
  • D Finally, we ensure this section of the string ends with a 'D'

The expression would match inputs such as ABBD, ABCCCCD, ABCBCCCD and ACCCCCD

It most cases, it doesn't take very long for a regex engine to find a match:

$ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD")'
0.04s user 0.01s system 95% cpu 0.052 total

$ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX")'
1.79s user 0.02s system 99% cpu 1.812 total

The entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.

Most Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as catastrophic backtracking.

Let's look at how our expression runs into this problem, using a shorter string: "ACCCX". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:

  1. CCC
  2. CC+C
  3. C+CC
  4. C+C+C.

The engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use RegEx 101 debugger to see the engine has to take a total of 38 steps before it can determine the string doesn't match.

From there, the number of steps the engine must use to validate a string just continues to grow.

String Number of C's Number of steps
ACCCX 3 38
ACCCCX 4 71
ACCCCCX 5 136
ACCCCCCCCCCCCCCX 14 65,553

By the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.

Remediation

Upgrade minimatch to version 3.0.5 or higher.

References

Regular Expression Denial of Service (ReDoS) vulnerability report

medium severity
new

Uncaught Exception

  • Vulnerable module: uri-js
  • Introduced through: electron-builder@22.14.13 and electron-rebuild@2.3.5

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › app-builder-lib@22.14.13 › @develar/schema-utils@2.6.5 › ajv@6.15.0 › uri-js@4.4.1
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › dmg-builder@22.14.13 › dmg-license@1.0.11 › ajv@6.15.0 › uri-js@4.4.1
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-builder@22.14.13 › dmg-builder@22.14.13 › app-builder-lib@22.14.13 › @develar/schema-utils@2.6.5 › ajv@6.15.0 › uri-js@4.4.1
  • Introduced through: edex-ui@GitSquared/edex-ui › electron-rebuild@2.3.5 › node-gyp@7.1.2 › request@2.88.2 › har-validator@5.1.5 › ajv@6.15.0 › uri-js@4.4.1

Overview

uri-js is a RFC 3986/3987 compliant, scheme extendable URI/IRI parsing/validating/resolving library for JavaScript.

Affected versions of this package are vulnerable to Uncaught Exception in the parse() function of src/schemes/mailto.ts, whose to branch calls hfield[1].split(",") directly, while the subject, body, and default branches all route through unescapeComponent(), which short-circuits on a missing value. An attacker can crash the process by supplying a mailto URI whose query carries a bare to token with no =value, such as mailto:?to, so splitting on = yields a one element array and the undefined second element is dereferenced. This requires the application to pass an attacker-influenced string to URI.parse(), URI.resolve(), URI.normalize(), or URI.equal(), none of which wrap the scheme handler in a try/catch, and whether the throw terminates the process or only fails the one request depends on the host's own error handling.

Remediation

There is no fixed version for uri-js.

References

Uncaught Exception vulnerability report

medium severity

Arbitrary Code Injection

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@35.7.5.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Arbitrary Code Injection via modification of the resources folder when the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses are enabled. An attacker can execute unauthorized code by altering files within the application directory, bypassing ASAR integrity checks.

Note: This is only exploitable if the application is launched from a filesystem to which the attacker has write access.

Remediation

Upgrade electron to version 35.7.5, 36.8.1, 37.3.1, 38.0.0-beta.6 or higher.

References

Arbitrary Code Injection vulnerability report

medium severity

Information Exposure

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@36.3.0.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Information Exposure via the Loader component. An attacker can leak sensitive cross-origin data by crafting a malicious HTML page.

Remediation

Upgrade electron to version 36.3.0 or higher.

References

Information Exposure vulnerability report

medium severity

Origin Validation Error

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@38.8.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Origin Validation Error in the session.setPermissionRequestHandler function. An attacker can gain unauthorized access to permissions such as fullscreen, pointerLock, keyboardLock, openExternal, or media by embedding malicious iframes that exploit the incorrect origin parameter passed to the handler. This may result in third-party content being granted permissions intended only for trusted origins.

Note:

This is only exploitable if the application grants permissions based on the origin parameter or webContents.getURL() rather than details.requestingUrl.

Workaround

This vulnerability can be mitigated by inspecting details.requestingUrl instead of the origin parameter or webContents.getURL() in the setPermissionRequestHandler when deciding whether to grant permissions.

Remediation

Upgrade electron to version 38.8.6, 39.8.1, 40.8.1, 41.0.0 or higher.

References

Origin Validation Error vulnerability report

medium severity

Improper Authentication

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@18.3.11.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Improper Authentication by allowing the creation of cookies that have an empty name field and whose value impersonates a cookie name prefix.

Note:

Upgrading to the fixed version will delete any previously stored cookies that meet the conditions by causing them to fail their IsCanonical() check.

Remediation

Upgrade electron to version 18.3.11 or higher.

References

Improper Authentication vulnerability report

medium severity

Improper implementation

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@15.5.3.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Improper implementation in Compositing.

Remediation

Upgrade electron to version 15.5.3, 16.2.4 or higher.

References

Improper implementation vulnerability report

low severity

Improper Access Control

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@13.6.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Improper Access Control via the web Bluetooth API, if the app has not configured a custom select-bluetooth-device event handler. The device that is accessed is random and the attacker would have no way of selecting a specific device.

Workarounds:

Adding this code to your app can workaround the issue.

app.on('web-contents-created', (event, webContents) => {
  webContents.on('select-bluetooth-device', (event, devices, callback) => {
    // Prevent default behavior
    event.preventDefault();
    // Cancel the request
    callback('');
  });
});

Remediation

Upgrade electron to version 13.6.6, 14.2.4, 15.3.5, 16.0.6, 17.0.0-alpha.6 or higher.

References

Improper Access Control vulnerability report

low severity

NULL Pointer Dereference

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@39.8.5.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to NULL Pointer Dereference in the clipboard.readImage() function when processing malformed clipboard image data. An attacker can cause the application to crash by placing invalid image data on the system clipboard and triggering the function.

Remediation

Upgrade electron to version 39.8.5, 40.8.5, 41.1.0, 42.0.0-alpha.5 or higher.

References

NULL Pointer Dereference vulnerability report

low severity
new

Cross-site Request Forgery (CSRF)

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@42.11.3.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) via the OpenURLFromTab handler, which fails to route modifier-click and middle-click link navigations (and target-form-post popups) through the window-open policy. A <webview> tag without allowpopups is supposed to block popup creation, but because these link-triggered navigations bypass the CanCreateWindow check that window.open() already passes through, an attacker-controlled page loaded in such a <webview> can open new windows that should have been blocked. Additionally, the new window starts its navigation from a fresh browser-initiated loadURL rather than from the original OpenURLParams, causing incorrect attribution of the initiator origin, Sec-Fetch-Site, SameSite cookies, and external protocol handling.

Note: This is only exploitable if the application loads untrusted content and allows it to open new windows.

Remediation

Upgrade electron to version 42.11.3, 43.7.0, 44.3.0, 45.0.0-alpha.6 or higher.

References

Cross-site Request Forgery (CSRF) vulnerability report

low severity

Exposure of Resource to Wrong Sphere

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@39.8.5.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere via the window.open() function. An attacker can gain access to or manipulate the browsing context of a window opened by a different renderer by using the same target name, potentially inheriting elevated permissions such as privileged preload scripts or relaxed security settings. This is only exploitable if multiple top-level windows with differing trust levels are opened and setWindowOpenHandler is used to grant elevated webPreferences to child windows.

Workaround

This vulnerability can be mitigated by denying window.open() in renderers that load untrusted content by returning { action: 'deny' } from setWindowOpenHandler and avoiding granting child windows more permissive webPreferences than their opener.

Remediation

Upgrade electron to version 39.8.5, 40.8.5, 41.1.0, 42.0.0-alpha.5 or higher.

References

Exposure of Resource to Wrong Sphere vulnerability report

low severity

Improper Restriction of Rendered UI Layers or Frames

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@39.8.8.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Improper Restriction of Rendered UI Layers or Frames in the handling of cross-origin iframes, which allows the native autofill popup to be positioned outside the bounds of the iframe and over the embedding page's UI. An attacker can manipulate the placement of the autofill popup by embedding untrusted content in an iframe, potentially enabling clickjacking or spoofing of trusted UI.

Note: This is only exploitable if untrusted content is embedded in iframes within windows that also display trusted UI.

Workaround

This vulnerability can be mitigated by not embedding untrusted content in iframes inside windows that display trusted UI.

Remediation

Upgrade electron to version 39.8.8, 40.9.1, 41.2.1, 42.0.0-beta.3 or higher.

References

Improper Restriction of Rendered UI Layers or Frames vulnerability report

low severity
new

Missing Authorization

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@42.11.1.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Missing Authorization in TabsQueryFunction::Run in shell/browser/extensions/api/tabs/tabs_api.cc, where the tabs.query API populates the privileged url and title tab properties unconditionally, regardless of whether the calling extension holds the tabs permission or has host access to the tab's origin. An extension without those permissions can call tabs.query to read the URL and title of any open tab, leaking information that should be gated behind the tabs permission or host access. The tabs.get and tabs.update APIs already enforced this check correctly; only tabs.query was missing the guard.

Note: Apps are only affected if they load extensions via session.extensions.loadExtension that they do not fully trust.

Remediation

Upgrade electron to version 42.11.1, 43.5.1, 44.1.1, 45.0.0-alpha.4 or higher.

References

Missing Authorization vulnerability report

low severity

Missing Authorization

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@38.8.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Missing Authorization in the select-usb-device event callback, which did not validate the chosen device ID against the filtered list presented to the handler. An attacker can gain unauthorized access to USB devices that do not match the intended filters or are listed in exclusion filters by influencing the handler to select a device ID outside the allowed set.

Note:

This is only exploitable if the application implements unusual device-selection logic that can be manipulated.

Remediation

Upgrade electron to version 38.8.6, 39.8.0, 40.7.0, 41.0.0-beta.8 or higher.

References

Missing Authorization vulnerability report

low severity
new

Out-of-bounds Read

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@42.11.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Out-of-bounds Read via the OnFrameCaptured function in shell/browser/api/frame_subscriber.cc, where a captured video frame's layout metadata (content_rect and coded_size) is not validated against the actual shared memory mapping size before constructing an SkBitmap over it. An attacker with code execution in the GPU process can supply a frame whose content_rect exceeds the bounds of the shared memory region, causing an out-of-bounds read when the bitmap pixels are accessed.

Note: This is only exploitable when the application uses offscreen rendering (webPreferences.offscreen) on macOS and an attacker has separately gained code execution in the GPU process.

Remediation

Upgrade electron to version 45.0.0-alpha.9, 44.4.3, 43.7.3, 42.11.6 or higher.

References

Out-of-bounds Read vulnerability report

low severity
new

Out-of-bounds Read

  • Vulnerable module: electron
  • Introduced through: electron@12.2.3

Detailed paths

  • Introduced through: edex-ui@GitSquared/edex-ui › electron@12.2.3
    Remediation: Upgrade to electron@42.11.6.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Out-of-bounds Read via the OnFrameCaptured function in shell/browser/api/frame_subscriber.cc, when processing a captured video frame whose content_rect and coded_size fields are not validated against the actual shared-memory mapping size before pixel data is read. An attacker with code execution in the GPU process can supply a malformed frame layout over Mojo, causing the renderer to read memory outside the shared-memory region and potentially disclose contents or crash the renderer process.

Note: This is only exploitable if the app uses webContents.beginFrameSubscription and an attacker has separately gained code execution in the GPU process.

Remediation

Upgrade electron to version 45.0.0-alpha.9, 44.4.3, 43.7.3, 42.11.6 or higher.

References

Out-of-bounds Read vulnerability report