CVE-2024-39698: electron-userland electron-builder

Vulnerability summary

CVE-2024-39698 is a high (CVSS 7.5) vulnerability in electron-userland electron-builder. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 35.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 09-07-2024
   PublishedVulnerability first disclosed.
2. 02-08-2024
   Last modifiedVulnerability information updated.

Description

electron-updater allows for automatic updates for Electron apps. The file `packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts` implements the signature validation routine for Electron applications on Windows. Because of the surrounding shell, a first pass by `cmd.exe` expands any environment variable found in command-line above. This creates a situation where `verifySignature()` can be tricked into validating the certificate of a different file than the one that was just downloaded. If the step is successful, the malicious update will be executed even if its signature is invalid. This attack assumes a compromised update manifest (server compromise, Man-in-the-Middle attack if fetched over HTTP, Cross-Site Scripting to point the application to a malicious updater server, etc.). The patch is available starting from 6.3.0-alpha.6.

• CWE-154Improper Neutralization of Variable Name DelimitersThe product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as variable name delimiters when they are sent to a downstream component.
• CWE-295Improper Certificate ValidationThe product does not validate, or incorrectly validates, a certificate.