CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
Percentile
99.8%
Affected versions of electron
may be susceptible to a remote code execution flaw when certain conditions are met:
nodeapp://
.This vulnerability is caused by a failure to sanitize additional arguments to chromium in the command line handler for Electron.
MacOS and Linux are not vulnerable.
Update electron to a version that is not vulnerable. If updating is not possible, the electron team has provided the following guidance:
If for some reason you are unable to upgrade your Electron version, you can append --
as the last argument when calling app.setAsDefaultProtocolClient
, which prevents Chromium from parsing further options. The double dash --
signifies the end of command options, after which only positional parameters are accepted.
app.setAsDefaultProtocolClient(protocol, process.execPath, [
'--your-switches-here',
'--'
])
www.securityfocus.com/bid/102796
electronjs.org/blog/protocol-handler-fix
github.com/advisories/GHSA-w222-53c6-c86p
github.com/electron/electron/releases/tag/v1.8.2-beta.4
medium.com/@Wflki/exploiting-electron-rce-in-exodus-wallet-d9e6db13c374
nvd.nist.gov/vuln/detail/CVE-2018-1000006
www.exploit-db.com/exploits/43899/
www.exploit-db.com/exploits/44357/
www.npmjs.com/advisories/563
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
Percentile
99.8%