Electron up to 15.5.4/16.2.5/17.1.x/18.0.0-beta.5 exposure of resource

Summaryinfo

A vulnerability was found in Electron up to 15.5.4/16.2.5/17.1.x/18.0.0-beta.5 and classified as critical. Affected is an unknown function. Executing a manipulation can lead to exposure of resource. This vulnerability is tracked as CVE-2022-29247. The attack can be launched remotely. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in Electron up to 15.5.4/16.2.5/17.1.x/18.0.0-beta.5. This vulnerability affects an unknown code. The manipulation with an unknown input leads to a exposure of resource vulnerability. The CWE definition for the vulnerability is CWE-668. The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource. As an impact it is known to affect confidentiality. CVE summarizes:

Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows a renderer with JS execution to obtain access to a new renderer process with `nodeIntegrationInSubFrames` enabled which in turn allows effective access to `ipcRenderer`. The `nodeIntegrationInSubFrames` option does not implicitly grant Node.js access. Rather, it depends on the existing sandbox setting. If an application is sandboxed, then `nodeIntegrationInSubFrames` just gives access to the sandboxed renderer APIs, which include `ipcRenderer`. If the application then additionally exposes IPC messages without IPC `senderFrame` validation that perform privileged actions or return confidential data this access to `ipcRenderer` can in turn compromise your application / user even with the sandbox enabled. Electron versions 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 contain a fix for this issue. As a workaround, ensure that all IPC message handlers appropriately validate `senderFrame`.

The weakness was disclosed 06/14/2022 as GHSA-mq8j-3h7h-p8g7. The advisory is shared for download at github.com. This vulnerability was named CVE-2022-29247 since 04/13/2022. There are neither technical details nor an exploit publicly available.

Upgrading to version 15.5.5, 16.2.6, 17.2.0 or 18.0.0-beta.6 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Electron

Version

• 15.5.0
• 15.5.1
• 15.5.2
• 15.5.3
• 15.5.4
• 16.2.0
• 16.2.1
• 16.2.2
• 16.2.3
• 16.2.4
• 16.2.5
• 17.0
• 17.1
• 18.0.0-beta.0
• 18.0.0-beta.1
• 18.0.0-beta.2
• 18.0.0-beta.3
• 18.0.0-beta.4
• 18.0.0-beta.5

Website

• Product: https://github.com/electron/electron/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion