Security flaw in Electron impacts hundreds of desktop apps

This is the second critical remote code execution vulnerability of the year for Electron.

A security flaw in Electron, an extremely popular web application framework, leaves vulnerable targets open to remote code execution attacks.

Electron underlies widely used desktop apps like Skype and Slack. This is the second critical remote code execution vulnerability of the year for Electron, after a Microsoft Windows app bug was publicly unveiled in January.

This latest flaw was discovered by Trustwave researcher Brendan Scarvell. Electron has already issued a patch addressing the flaw, but it’s up to developers to implement it. Versions below 1.7.13, 1.8.4 and 2.0.0-beta.3 are vulnerable.

Apps using those versions are vulnerable to cross-site scripting (XSS) attacks due to a failure to sanitize user input. Due to some specifics within Electron — explained in great detail here by Scarvell — it’s a relatively small jump to escalate that to remote code execution, which could then lead to full ownership of a machine.

“A default Electron application includes access to not only its own APIs, but also includes access to all of Node.js’ built in modules. This makes XSS particularly dangerous, as an attacker’s payload can allow do some nasty things such as require in the child_process module and execute system commands on the client-side,” Scarvell said.

It’s not yet clear which specific apps are vulnerable. Signal, which builds its desktop app upon Electron, indicated that their app is not vulnerable to this flaw.

We’ve emailed Electron, the researchers and several developers to get a better idea of which apps were and are vulnerable, as well as how a user might be able to tell. We will update the story if and when we receive a response.

For both developers and users, the key is to download and install the security patches as quickly as possible.

Developers who might be unable to upgrade can mitigate the threat by following Electron’s instructions here.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure