Electron up to 18.3.6/19.0.10/20.0.0 file URL information disclosure

Summaryinfo

A vulnerability identified as problematic has been detected in Electron up to 18.3.6/19.0.10/20.0.0. This affects an unknown function of the component file URL Handler. The manipulation leads to information disclosure. This vulnerability is traded as CVE-2022-36077. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Electron up to 18.3.6/19.0.10/20.0.0 and classified as problematic. This issue affects some unknown functionality of the component file URL Handler. The manipulation with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. The summary by CVE is:

The Electron framework enables writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions prior to 21.0.0-beta.1, 20.0.1, 19.0.11, and 18.3.7, Electron is vulnerable to Exposure of Sensitive Information. When following a redirect, Electron delays a check for redirecting to file:// URLs from other schemes. The contents of the file is not available to the renderer following the redirect, but if the redirect target is a SMB URL such as `file://some.website.com/`, then in some cases, Windows will connect to that server and attempt NTLM authentication, which can include sending hashed credentials.This issue has been patched in versions: 21.0.0-beta.1, 20.0.1, 19.0.11, and 18.3.7. Users are recommended to upgrade to the latest stable version of Electron. If upgrading isn't possible, this issue can be addressed without upgrading by preventing redirects to file:// URLs in the `WebContents.on('will-redirect')` event, for all WebContents as a workaround.

The weakness was shared 11/08/2022 as GHSA-p2jh-44qj-pf2v. The advisory is shared at github.com. The identification of this vulnerability is CVE-2022-36077 since 07/15/2022. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

Upgrading to version 18.3.7, 19.0.11, 20.0.1 or 21.0.0-beta.1 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• Electron

Version

• 18.3.0
• 18.3.1
• 18.3.2
• 18.3.3
• 18.3.4
• 18.3.5
• 18.3.6
• 19.0.0
• 19.0.1
• 19.0.2
• 19.0.3
• 19.0.4
• 19.0.5
• 19.0.6
• 19.0.7
• 19.0.8
• 19.0.9
• 19.0.10
• 20.0

Website

• Product: https://github.com/electron/electron/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion