electron-updater@3.2.3

Vulnerabilities

 2 via 2 paths

Dependencies

 23

Source

 npm
Find a vulnerability free version of electron-updater | View electron-updater package health on Snyk Advisor

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 2
Status
  • 2
  • 0
  • 0

medium severity

Signature Validation Bypass

  • Vulnerable module: electron-updater
  • Introduced through: electron-updater@3.2.3

Detailed paths

  • Introduced through: electron-updater@3.2.3
    Remediation: Upgrade to electron-updater@4.2.2.

Overview

electron-updater is a module allowing applications to implement auto-update functionality.

Affected versions of this package are vulnerable to Signature Validation Bypass. The signature verification check is based on a string comparison between the installed binary’s publisherName and the certificate’s Common Name attribute of the update binary. During a software update, the application will request a file named latest.yml from the update server, which contains the definition of the new release - including the binary filename and hashes.

Using a filename containing a single quote and a matching hash, an attacker could bypass the entire signature verification by triggering a parse error in the script.

This can be leveraged to force a malicious update on Windows clients, effectively gaining code execution and persistence capabilities.

Exploitation of this vulnerability requires the attacker to also have control over the update server, or alternatively a man-in-the-middle.

Remediation

Upgrade electron-updater to version 4.2.2 or higher.

References

Signature Validation Bypass vulnerability report

medium severity

Signature Validation Bypass

  • Vulnerable module: electron-updater
  • Introduced through: electron-updater@3.2.3

Detailed paths

  • Introduced through: electron-updater@3.2.3
    Remediation: Upgrade to electron-updater@4.3.1.

Overview

electron-updater is a module allowing applications to implement auto-update functionality.

Affected versions of this package are vulnerable to Signature Validation Bypass. The signature verification check is based on a string comparison between the installed binary’s publisherName and the certificate’s Common Name attribute of the update binary. During a software update, the application will request a file named latest.yml from the update server, which contains the definition of the new release - including the binary filename and hashes.

Using a filename containing a backtick (`), among other symbols and a matching hash, an attacker could bypass the entire signature verification by triggering a parse error in the script.

This can be leveraged to force a malicious update on Windows clients, effectively gaining code execution and persistence capabilities.

Exploitation of this vulnerability requires the attacker to also have control over the update server, or alternatively a man-in-the-middle.

A partial fix has been made available, blacklisting a small set of characters, but there are additional characters that can be used to exploit this vulnerability.

Remediation

Upgrade electron-updater to version 4.3.1 or higher.

References

Signature Validation Bypass vulnerability report