CVE-2024-27303: electron-builder's NSIS installer - execute arbitrary code on the target machine (Windows only)
Impact Windows-Only: The NSIS installer makes a system call to open cmd.exe via NSExec in the .nsh installer script. NSExec by default searches the current directory of where the installer is located before searching PATH. This means that if an attacker can place a malicious executable file named cmd.exe in the same folder as the installer, the installer will run the malicious file.
Patches Fixed in https://github.com/electron-userland/electron-builder/pull/8059
Workarounds None, it executes at the installer-level before the app is present on the system, so there's no way to check if it exists in a current installer.
References https://cwe.mitre.org/data/definitions/426.html https://cwe.mitre.org/data/definitions/427
Other sources
electron-builder is a solution to package and build a ready for distribution Electron, Proton Native app for macOS, Windows and Linux. A vulnerability that only affects eletron-builder prior to 24.13.2 in Windows, the NSIS installer makes a system call to open cmd.exe via NSExec in the .nsh installer script. NSExec by default searches the current directory of where the installer is located before searching PATH. This means that if an attacker can place a malicious executable file named cmd.exe in the same folder as the installer, the installer will run the malicious file. Version 24.13.2 fixes this issue. No known workaround exists. The code executes at the installer-level before the app is present on the system, so there's no way to check if it exists in a current installer.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27303?
CVE-2024-27303 has a severe impact on Windows systems due to the risk of executing arbitrary commands via a compromised installer.
How do I fix CVE-2024-27303?
To fix CVE-2024-27303, update the app-builder-lib package to version 24.13.2 or later.
What software is affected by CVE-2024-27303?
The affected software includes the app-builder-lib package and versions of Electron Builder up to 24.13.2.
What type of vulnerability is CVE-2024-27303?
CVE-2024-27303 is a command execution vulnerability introduced through the NSIS installer system call.
Is CVE-2024-27303 specific to any operating system?
Yes, CVE-2024-27303 specifically affects Windows operating systems.