PT-2018-9198 · Microsoft+2 · Windows 2008+4

Wflki · Published 2018-01-23 · Updated 2023-10-05 · CVE-2018-1000006

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: GitHub Electron versions 1.8.2-beta.3 and earlier GitHub Electron versions 1.7.10 and earlier GitHub Electron versions 1.6.15 and earlier

Description: The issue is related to a vulnerability in the protocol handler of Electron apps running on Windows 10, 7, or 2008. If an Electron application registers a custom protocol handler, it can be tricked into arbitrary command execution when a user clicks on a specially crafted URL. This vulnerability is caused by a failure to sanitize additional arguments to Chromium in the command line handler for Electron. The estimated number of potentially affected devices is not provided.

Recommendations: For GitHub Electron versions 1.8.2-beta.3 and earlier, update to version 1.8.2-beta.4 or later. For GitHub Electron versions 1.7.10 and earlier, update to version 1.7.11 or later. For GitHub Electron versions 1.6.15 and earlier, update to version 1.6.16 or later. If updating is not possible, append -- as the last argument when calling app.setAsDefaultProtocolClient to prevent Chromium from parsing further options. For example:

app.setAsDefaultProtocolClient(protocol, process.execPath, [
 '--your-switches-here',
 '--'
])

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2018-1000006

GHSA-W222-53C6-C86P

ZDI-18-265

ZDI-18-308

ZDI-18-426

ZDI-18-552

Affected Products

Chromium

Github Electron

Windows 10

Windows 2008

Windows 7

References · 23

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/exodus.rb · Exploit
• 🔥 https://github.com/CHYbeta/CVE-2018-1000006-DEMO · Exploit
• 🔥 https://medium.com/@Wflki/exploiting-electron-rce-in-exodus-wallet-d9e6db13c374 · Exploit
• 🔥 https://exploit-db.com/exploits/44357 · Exploit
• 🔥 https://xianzhi.aliyun.com/forum/topic/1994?from=timeline&isappinstalled=0 · Exploit
• 🔥 https://exploit-db.com/exploits/43899 · Exploit
• https://github.com/electron/electron/releases/tag/v1.8.2-beta.4 · Patch
• https://zerodayinitiative.com/advisories/ZDI-18-308 · Security Note
• https://osv.dev/vulnerability/GHSA-w222-53c6-c86p · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-18-552 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000006 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-18-426 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-18-265 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1000006 · Vendor Advisory
• https://github.com/Inplex-sys/BlackCap-Grabber-NoDualHook · Note