CVE-2018-1000006: OS Command Injection
First published: Wed Jan 24 2018(Updated: )
GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the protocol handler, specifically Electron apps running on Windows 10, 7 or 2008 that register custom protocol handlers can be tricked in arbitrary command execution if the user clicks on a specially crafted URL. This has been fixed in versions 1.8.2-beta.4, 1.7.11, and 1.6.16.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Atom Electron | =1.8.2-beta1 | |
| Atom Electron | =1.8.2-beta2 | |
| Atom Electron | =1.8.2-beta3 | |
| Microsoft Windows 10 | ||
| Microsoft Windows 7 | ||
| Microsoft Windows Server | ||
| Atom Electron | <=1.7.10 | |
| Atom Electron | <=1.6.15 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/102796
- https://electronjs.org/blog/protocol-handler-fix
- https://github.com/electron/electron/releases/tag/v1.8.2-beta.4
- https://medium.com/@Wflki/exploiting-electron-rce-in-exodus-wallet-d9e6db13c374
- https://www.exploit-db.com/exploits/43899/
- https://www.exploit-db.com/exploits/44357/
- https://medium.com/%40Wflki/exploiting-electron-rce-in-exodus-wallet-d9e6db13c374
Frequently Asked Questions
What is the severity of CVE-2018-1000006?
CVE-2018-1000006 is classified as a high severity vulnerability due to its potential for arbitrary command execution.
How do I fix CVE-2018-1000006?
To fix CVE-2018-1000006, upgrade to Electron version 1.8.2-beta.4 or later.
Which versions of Electron are affected by CVE-2018-1000006?
CVE-2018-1000006 affects Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, and 1.6.15 and earlier.
What platforms are impacted by CVE-2018-1000006?
CVE-2018-1000006 primarily impacts Electron applications running on Windows 10, Windows 7, and Windows Server 2008.
What type of vulnerability is CVE-2018-1000006?
CVE-2018-1000006 is a protocol handler vulnerability that can lead to arbitrary command execution when exploited.
- agent/type
- agent/remedy
- agent/weakness
- agent/author
- agent/severity
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/atom
- canonical/atom electron
- version/atom electron/1.8.2-beta1
- version/atom electron/1.8.2-beta2
- version/atom electron/1.8.2-beta3
- vendor/microsoft
- canonical/microsoft windows 10
- canonical/microsoft windows 7
- canonical/microsoft windows server
- version/atom electron/1.7.10
- version/atom electron/1.6.15