PT-2018-9296 · Github · Electron

Marshallofsound · Publicado 2018-03-07 · Atualizado 2018-04-20 · CVE-2018-1000118

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Github Electron versions 1.8.2-beta.4 and earlier

Description: The issue is related to a Command Injection vulnerability in the Protocol Handler of Github Electron. This vulnerability can be exploited when a victim opens an Electron protocol handler in their browser, potentially allowing an attacker to execute commands. The vulnerability is due to an incomplete fix, specifically because the blacklist used was not case insensitive, allowing an attacker to potentially bypass it.

Recommendations: For Github Electron versions 1.8.2-beta.4 and earlier, update to Electron 1.8.2-beta.5 or later to resolve the issue.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2018-1000118

GHSA-FJQR-FX3F-G4RV

Produtos afetados

Electron

Referências · 6

• https://github.com/electron/electron/commit/ce361a12e355f9e1e99c989f1ea056c9e502dbe7 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000118 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-1000118 · Aviso do Fabricante
• https://github.com/advisories/GHSA-fjqr-fx3f-g4rv · Nota
• https://electronjs.org/releases#1.8.2-beta.5 · Nota
• https://osv.dev/vulnerability/GHSA-fjqr-fx3f-g4rv · Aviso do Fabricante