PT-2022-4290 · Electron · Electron

Marshallofsound + 2 · Published 2022-06-13 · Updated 2022-06-27 · CVE-2022-29247

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Electron versions prior to 18.0.0-beta.6 Electron versions prior to 17.2.0 Electron versions prior to 16.2.6 Electron versions prior to 15.5.5

Description The issue is related to the nodeIntegrationInSubFrames parameter in Electron, which can lead to information disclosure. A renderer with JavaScript execution can obtain access to a new renderer process with nodeIntegrationInSubFrames enabled, allowing effective access to ipcRenderer. This access can compromise the application or user if the application exposes IPC messages without IPC senderFrame validation that perform privileged actions or return confidential data.

Recommendations For versions prior to 18.0.0-beta.6, update to version 18.0.0-beta.6 or later. For versions prior to 17.2.0, update to version 17.2.0 or later. For versions prior to 16.2.6, update to version 16.2.6 or later. For versions prior to 15.5.5, update to version 15.5.5 or later. As a temporary workaround, ensure that all IPC message handlers appropriately validate senderFrame.

Exploit

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

BDU:2022-05144

CVE-2022-29247

GHSA-MQ8J-3H7H-P8G7

Affected Products

Electron

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29247.json · Exploit
• https://bdu.fstec.ru/vul/2022-05144 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-29247 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29247 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mq8j-3h7h-p8g7 · Vendor Advisory
• https://github.com/electron/electron · Note
• https://github.com/electron/electron/security/advisories/GHSA-mq8j-3h7h-p8g7 · Note
• https://t.me/cibsecurity/44339 · Telegram Post