CVSS 7.5 · High EPSS 0,43%
Kerentanan Improper Neutralization of Variable Name Delimiters pada electron-builder. Skor CVSS 3.1 7.5 (High) menurut NVD.
electron-updater allows for automatic updates for Electron apps. The file `packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts` implements the signature validation routine for Electron applications on Windows. Because of the surrounding shell, a first pass by `cmd.exe` expands any environment variable found in command-line above. This creates a situation where `verifySignature()` can be tricked into validating the certificate of a different file than the one that was just downloaded. If the step is successful, the malicious update will be executed even if its signature is invalid. This attack assumes a compromised update manifest (server compromise, Man-in-the-Middle attack if fetched over HTTP, Cross-Site Scripting to point the application to a malicious updater server, etc.). The patch is available starting from 6.3.0-alpha.6.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| electron | electron-builder | Semua versi sebelum 6.3.0 |
| electron | electron-builder | Versi 6.3.0 alpha0 |
| electron | electron-builder | Versi 6.3.0 alpha1 |
| electron | electron-builder | Versi 6.3.0 alpha2 |
| electron | electron-builder | Versi 6.3.0 alpha3 |
| electron | electron-builder | Versi 6.3.0 alpha4 |
| electron | electron-builder | Versi 6.3.0 alpha5 |